SCS-C02 Hard Questions — 25 Difficult Questions

Question 1

A company is migrating a legacy application to AWS. The application requires two-way communication between the web servers and the database servers using TCP port 3306. The security team wants to follow the principle of least privilege. Which TWO actions should be taken to secure the traffic?

Accepted Answer

Create a security group for the web servers that allows outbound traffic on port 3306 to the database security group.. Option A is correct because security groups are stateful, so allowing outbound traffic on port 3306 from the web servers to the database security group automatically permits the corresponding return traffic. This adheres to the principle of least privilege by specifying the destination as the database security group ID rather than a broad CIDR range, ensuring only the intended web servers can initiate the connection.

Answer

Create a security group for the database servers that allows inbound traffic on port 3306 from the web subnet CIDR.

Answer

Place the database servers in a public subnet for easier connectivity.

Answer

Configure the network ACL for the database subnet to allow inbound traffic on port 3306 from the web subnet CIDR.

Question 2

A security engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises server over a Direct Connect virtual interface. The EC2 instance has a security group that allows outbound traffic to the on-premises CIDR block (10.0.0.0/16). The VPC has a route table entry pointing the on-premises CIDR to the virtual private gateway. The on-premises firewall shows that packets are received from the EC2 instance but responses are not reaching the instance. What is the most likely cause?

Accepted Answer

The on-premises router does not have a route pointing the VPC CIDR back to the Direct Connect interface.. The on-premises firewall logs show packets are received from the EC2 instance, but responses are not reaching it. This indicates a routing issue on the on-premises side: the on-premises router must have a route pointing the VPC CIDR back to the Direct Connect interface (virtual interface) for return traffic to be forwarded correctly. Without this return route, the on-premises server sends responses via its default route (likely the internet), which are dropped by the VPC security group or never reach the EC2 instance.

Answer

The network ACL for the subnet is blocking outbound traffic to the on-premises CIDR.

Answer

The virtual private gateway is not attached to the VPC.

Answer

The security group does not allow inbound traffic from the on-premises server.

Question 3

A developer is trying to upload an object to an S3 bucket named 'my-bucket' using the AWS CLI. The developer has an IAM user with a policy that includes 's3:PutObject' for 'arn:aws:s3:::my-bucket/*'. However, the upload fails with an 'Access Denied' error. The bucket policy is set to allow all principals from the same AWS account to perform 's3:PutObject'. What is the most likely cause of this failure?

Accepted Answer

The IAM policy grants 's3:PutObject' only on objects (/*), but the request may also require 's3:PutObject' on the bucket itself for some operations.. Option C is correct because the IAM policy grants 's3:PutObject' only on the bucket's object ARN (arn:aws:s3:::my-bucket/*), but certain S3 operations, such as multipart uploads initiated via the AWS CLI, may require the 's3:PutObject' permission on the bucket resource itself (arn:aws:s3:::my-bucket) to complete the upload. The bucket policy allows 's3:PutObject' for all principals in the same account, but the IAM user's policy is too restrictive, causing the 'Access Denied' error.

Answer

The IAM user is not authorized to perform 's3:PutObject' on the bucket 'my-bucket'.

Answer

The bucket policy denies access because the principal is not explicitly listed.

Answer

The bucket 'my-bucket' does not exist in the same region as the CLI request.

Question 4

An IAM policy is attached to a user. The user is trying to change their own password in the IAM console but receives an 'Access Denied' error. The user has an MFA device configured and is logged in with MFA. Why is the password change failing?

Accepted Answer

The Deny statement uses 'BoolIfExists' which evaluates to true if the condition key is not present. In the IAM console, the 'aws:MultiFactorAuthPresent' key may not be set, causing the Deny to apply even when the user has MFA.. Option B is correct because the Deny statement uses the `BoolIfExists` condition operator with the `aws:MultiFactorAuthPresent` key. In the IAM console, the `aws:MultiFactorAuthPresent` key may not be present in the request context (e.g., during the initial password change flow before MFA is re-validated), causing `BoolIfExists` to evaluate to true when the key is absent. This triggers the Deny even though the user has an MFA device and is logged in with MFA, blocking the `iam:ChangePassword` action.

Answer

The Allow statement for iam:ChangePassword is not sufficient because the Deny statement explicitly denies all actions.

Answer

The Deny statement denies all actions unconditionally, so the Allow statement cannot override it.

Answer

The user does not have permission to change their own password because the Allow statement is not specific enough.

Question 5

Refer to the exhibit. An organization applies this SCP to an OU containing a developer account. A developer in that account tries to launch an m5.large instance using the AWS Management Console. What is the outcome?

Accepted Answer

The launch fails because the SCP denies RunInstances for instance types other than t2.micro and t2.small.. The SCP explicitly denies the ec2:RunInstances action when the condition key ec2:InstanceType does not match t2.micro or t2.small. Since m5.large is not in the allowed list, the deny effect applies, and the launch fails regardless of any IAM policy that might allow it. SCPs act as a guardrail that overrides IAM permissions, so even if the developer has full IAM access, the SCP blocks the operation.

Answer

The instance launches successfully because the SCP only applies to StartInstances, not RunInstances.

Answer

The instance launches successfully because the SCP does not explicitly allow any actions.

Answer

The launch fails only if the developer's IAM policy also denies the action.

Question 6

A financial services company uses AWS KMS to encrypt sensitive data. The security team has a requirement to rotate the CMK every 90 days and to maintain a record of all previous key versions for decryption of historical data. The team creates a new CMK every 90 days and manually updates applications to use the new key. This process is error-prone and causes downtime. What is the MOST operationally efficient solution that meets the requirements?

Accepted Answer

Create a new CMK every 90 days and update the alias to point to the new key. Applications reference the alias.. Option B is correct because it uses aliases to decouple the key identifier from the application configuration. By creating a new CMK every 90 days and updating the alias to point to the new key, applications that reference the alias automatically use the new key without code changes, eliminating downtime. AWS KMS aliases are mutable pointers that can be reassigned to different CMKs, and the old key versions remain available for decryption of historical data.

Answer

Enable automatic key rotation on the existing CMK.

Answer

Use a CMK with imported key material and rotate the material every 90 days.

Answer

Continue creating new CMKs but use a script to update the application configuration files.

Question 7

A security engineer is designing a centralized logging solution for a multi-account AWS environment. They need to ensure log files are tamper-proof and cannot be deleted or modified by anyone, including the root user of any account. Which configuration meets these requirements?

Accepted Answer

Enable S3 Object Lock in Governance mode with a retention period, and use a separate account to manage the retention settings.. Option D is correct because S3 Object Lock in Governance mode prevents any user, including the root user, from deleting or overwriting objects until the retention period expires. By storing the logs in a separate account that manages the retention settings, the security engineer ensures that even if an attacker compromises the source account, they cannot modify or delete the logs because the lock is enforced by the destination account's S3 configuration.

Answer

Create a bucket policy that denies s3:DeleteObject and s3:PutObject to all principals.

Answer

Enable MFA Delete on the S3 bucket and configure CloudTrail to log to that bucket.

Answer

Enable CloudTrail log file validation and store logs in a separate account.

Question 8

A company stores sensitive data in Amazon S3 and wants to detect and alert on any public read access to objects. Which combination of services provides the most comprehensive solution?

Accepted Answer

Enable S3 server access logging and use Amazon Athena to query logs, with CloudWatch Events to alert on specific patterns. Option C is correct because S3 server access logs capture detailed records of all requests made to a bucket, including the requester, bucket name, request time, action, and response status. By using Amazon Athena to query these logs and CloudWatch Events to trigger alerts on patterns indicating public read access (e.g., a specific HTTP method like GET from an anonymous principal), you can detect and alert on unauthorized public reads comprehensively. This combination provides granular, queryable logging with event-driven alerting, covering both current and historical access patterns.

Answer

Enable VPC Flow Logs and analyze for S3 traffic

Answer

Use AWS Config rules to check for public bucket policies and alert via SNS

Answer

Enable S3 event notifications for all object-level events and send to Amazon SNS

Question 9

A company wants to implement least privilege access for a data analytics team that uses Amazon Athena to query data in S3. Which THREE steps should be taken?

Accepted Answer

Grant write access to an S3 bucket for query results. Option B is correct because Athena requires a dedicated S3 bucket to store query results, and granting write access to that specific bucket ensures the service can write output without exposing other data. This aligns with least privilege by limiting write permissions to only the necessary location.

Answer

Grant full S3 access to all buckets

Answer

Grant access to Amazon Redshift

Question 10

A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Configure the target group to use HTTPS protocol.. Option A is correct because configuring the target group to use HTTPS protocol ensures that traffic between the Application Load Balancer (ALB) and the EC2 instances is encrypted in transit. This enforces TLS encryption on the backend connection, meeting the requirement for data-in-transit protection between the ALB and instances.

Answer

Enable encryption at rest on the EC2 instances.

Answer

Use a network load balancer instead of an ALB.

Answer

Assign a certificate from ACM to the ALB listener.

Question 11

A large enterprise uses AWS Organizations with hundreds of accounts. The security team needs to enforce that all accounts have AWS CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account. The team also wants to ensure that no account can disable CloudTrail or delete the bucket. Which combination of controls meets these requirements?

Accepted Answer

Use a service control policy (SCP) to deny actions that disable CloudTrail or delete the bucket.. Service control policies (SCPs) are the correct mechanism because they allow the management account to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, `cloudtrail:UpdateTrail`, and `s3:DeleteBucket` actions, the security team can prevent any account (including root users) from disabling CloudTrail or deleting the centralized S3 bucket, regardless of IAM policies or direct resource-based policies.

Answer

Enable AWS CloudTrail in the management account and use S3 bucket policies.

Answer

Use an IAM policy in each account to prevent trail modifications.

Answer

Use AWS Config rules to detect and alert on disabled trails.

Question 12

Refer to the exhibit. A security engineer applied the bucket policy shown. What is the effect of this policy?

Accepted Answer

Only GetObject requests that use HTTP are denied.. The bucket policy uses a `NotIpAddress` condition with the `aws:SourceIp` key to deny `s3:GetObject` requests that do not originate from the specified IP range (192.0.2.0/24). However, the `Null` condition on `aws:SecureTransport` ensures the policy only applies when the request is not using HTTPS (i.e., when `aws:SecureTransport` is false). Therefore, only GetObject requests over HTTP are denied; HTTPS requests from any IP are allowed, and PutObject requests are unaffected.

Answer

All PutObject requests are denied.

Answer

Only GetObject requests from specific IP ranges are denied.

Answer

All GetObject requests to the bucket are denied.

Question 13

Which TWO steps should a security engineer take when responding to a confirmed security incident involving a compromised EC2 instance? (Choose 2.)

Accepted Answer

Isolate the instance by changing its security group to deny all traffic. Preserving the instance (snapshot) and isolating it (security group change) are key steps. Terminating immediately destroys evidence. Deleting logs is wrong. Reimaging without investigation destroys evidence.

Answer

Reimage the instance from a clean AMI immediately

Answer

Delete all CloudTrail logs related to the instance

Answer

Immediately terminate the instance to stop the attack

Question 14

A company runs a multi-account AWS environment using AWS Organizations. The security team uses AWS Config to monitor compliance. Recently, they noticed that a developer in the 'development' account created an S3 bucket that is publicly accessible. The security team wants to prevent this in the future by automatically remediating any public S3 bucket. They have an SCP that denies s3:PutBucketPublicAccessBlock, but developers are still making buckets public by using bucket ACLs. The security team wants to implement a solution that automatically fixes any bucket that becomes public. Which solution should they choose?

Accepted Answer

Use AWS Config with the s3-bucket-public-read-prohibited managed rule and an automatic remediation action using AWS Systems Manager Automation. Option B is correct because AWS Config's s3-bucket-public-read-prohibited managed rule evaluates S3 bucket ACLs and policies for public read access. When a noncompliant bucket is detected, an automatic remediation action using AWS Systems Manager Automation can invoke a custom SSM document (e.g., AWS-DisableS3BucketPublicReadWrite) to remove public ACLs or apply a bucket policy that denies public access. This provides automated, event-driven remediation without relying on manual intervention or incomplete SCPs.

Answer

Use CloudTrail to detect PutBucketAcl events and send to SNS for manual remediation

Answer

Update the SCP to deny s3:PutBucketAcl with a condition for public access

Answer

Attach an IAM policy to all users that denies s3:PutBucketAcl

Question 15

Refer to the exhibit. A security engineer finds the above IAM policy attached to an IAM group. The policy is intended to allow all EC2 actions only from the corporate network (10.0.0.0/8). However, users report that they can perform EC2 actions from outside the corporate network. What is the MOST likely reason?

Accepted Answer

The aws:SourceIp condition key does not apply to API calls made through the AWS Management Console; the console uses AWS IP addresses.. Option C is correct because the `aws:SourceIp` condition key does not evaluate the source IP of requests made through the AWS Management Console. When a user signs in to the console, the console makes API calls on their behalf using AWS service endpoints, which have AWS-owned IP addresses, not the user's corporate IP. Therefore, the condition `IpAddress` fails, and the policy denies console-based EC2 actions from the corporate network, but the policy actually allows all EC2 actions (since the default effect is Allow) when the condition is not met? Wait—the policy has an Allow effect with a condition; if the condition is not met, the Allow does not apply, but there is no explicit Deny, so other policies or the default implicit Deny would block the action. However, the question states users can perform EC2 actions from outside the corporate network, meaning the policy is not blocking them. The most likely reason is that the console uses AWS IP addresses, so the condition never matches, and the Allow never applies, but users are still able to perform actions because they are using the console? Actually, the console uses AWS IPs, so the condition `IpAddress` would not match, and the Allow would not apply, leading to implicit Deny—but users report they can perform actions. This indicates that the policy is not the only one; perhaps there is another policy allowing EC2 actions without conditions (Option A). But the question asks for the MOST likely reason given the exhibit and the intent. The trap is that the `aws:SourceIp` condition does not work for console-based API calls because the console uses AWS IP addresses, so the condition is effectively ignored for console users, allowing them to bypass the intended restriction. This is a well-known limitation documented by AWS.

Answer

The IAM group has an additional policy that allows all EC2 actions without conditions.

Answer

The policy allows access to all EC2 actions, but the condition only applies to the ec2:* actions, which includes all EC2 actions.

Answer

The policy should use a NotIpAddress condition instead of IpAddress.

Question 16

A security engineer is designing a solution to allow an external auditor to access logs in an S3 bucket in the company's AWS account. The auditor does not have an AWS account. The engineer needs to grant read-only access to the specific bucket for a limited time. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Use AWS STS to issue temporary credentials that the auditor can use to access the bucket.. Option C is correct because AWS Security Token Service (STS) can issue temporary, limited-privilege credentials (access key, secret key, and session token) that the auditor can use to authenticate API requests to the S3 bucket. This approach does not require the auditor to have an AWS account and allows the engineer to control the validity period (via the DurationSeconds parameter) to enforce a limited time window. Option D is correct because a pre-signed URL embeds temporary credentials and a specific expiration time, granting read-only access to a single object without requiring the auditor to have AWS credentials or an AWS account.

Answer

Enable S3 Access Analyzer on the bucket to generate findings for the auditor.

Answer

Create a cross-account IAM role in the company's account and share the role ARN with the auditor.

Answer

Configure the bucket policy to grant access to 'Principal': '*' with a condition that limits access to the auditor's IP address.

Question 17

During an incident response, a security engineer needs to collect memory and disk forensics from a running EC2 Windows instance without causing the instance to crash. The engineer has AWS Systems Manager SSM Agent installed. Which method should the engineer use?

Accepted Answer

Use AWS Systems Manager Inventory to collect memory and disk information.. Option B is correct because AWS Systems Manager Inventory can collect both memory and disk forensics from a running EC2 Windows instance without causing it to crash. The SSM Agent, already installed, allows Inventory to gather metadata such as running processes (memory) and file system details (disk) via the AWS-CollectInventory document, which is designed for live data collection without rebooting or halting the instance.

Answer

Create an AMI of the instance.

Answer

Use AWS Backup to create a backup of the instance.

Answer

Create an EBS snapshot of the root volume.

Question 18

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs with S3 access log analysis.. Amazon CloudWatch Logs can ingest and analyze S3 access logs, which record detailed information about requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. By analyzing these logs with CloudWatch Logs Insights or metric filters, you can detect large data transfers to external IPs and trigger alerts via CloudWatch Alarms, making it a valid detection and alerting mechanism for data exfiltration.

Answer

AWS Config with compliance rules.

Answer

VPC Flow Logs.

Question 19

A company wants to use AWS CloudTrail to monitor data events for all S3 buckets. Which THREE steps are necessary? (Choose THREE.)

Accepted Answer

Specify an S3 bucket to store the log files. Option A is correct because CloudTrail requires a destination S3 bucket to store the log files it generates. Without specifying a bucket, the trail cannot persist logs, and this bucket must have appropriate bucket policies to allow CloudTrail to write logs. This is a mandatory step when creating any trail, whether for management or data events.

Answer

Create a CloudWatch Events rule to forward data events

Answer

Enable CloudTrail Insights to detect unusual data access

Question 20

A company requires real-time analysis of AWS CloudTrail logs to detect unauthorized API calls. The logs are stored in Amazon S3. Which architecture minimizes latency and cost?

Accepted Answer

Send CloudTrail logs to Amazon CloudWatch Logs, then use a subscription filter to Amazon Kinesis Data Firehose delivering to Amazon OpenSearch Service. Option B is correct because it provides the lowest-latency path for real-time analysis: CloudTrail logs are delivered to CloudWatch Logs in near real-time, and a subscription filter streams them to Kinesis Data Firehose, which buffers and delivers directly to Amazon OpenSearch Service for immediate indexing and search. This architecture avoids batch processing, minimizes data movement overhead, and uses managed services that scale automatically, keeping both latency and cost low.

Answer

Use AWS Glue to crawl S3 and load into Amazon Redshift for analysis

Answer

Query CloudTrail logs directly using Amazon Athena

Answer

Configure S3 event notifications to invoke an AWS Lambda function that writes to Amazon OpenSearch Service