SCS-C02 Timed Hard Questions — 25 Difficult Questions

Question 1

A company wants to audit all API calls made to Amazon S3 within a specific AWS account. Which combination of services should be used to meet this requirement?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Logs.. AWS CloudTrail is the service that records all API calls made to Amazon S3 (and other AWS services) within an AWS account, capturing details such as the identity of the caller, the time of the call, the source IP address, and the request parameters. By delivering these logs to Amazon CloudWatch Logs, you can monitor, search, and set alarms on the API activity in real time, enabling comprehensive auditing of S3 operations.

Answer

Amazon Inspector and Amazon CloudWatch Logs.

Answer

Amazon GuardDuty and Amazon CloudWatch Logs.

Answer

AWS Config and Amazon CloudWatch Logs.

Question 2

A security team is designing an automated incident response system. The system must meet the following requirements: (1) automatically respond to GuardDuty findings, (2) ensure that response actions are logged and immutable, and (3) allow for human approval before destructive actions. Which services should the team use? (Select THREE.)

Accepted Answer

Amazon EventBridge. Amazon EventBridge (A) is correct because it can receive GuardDuty findings in near real-time and route them to downstream targets for automated response. This enables the first requirement by triggering workflows directly from GuardDuty events without custom polling.

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Question 3

A security engineer creates an Amazon CloudWatch Events rule with this event pattern to trigger an AWS Lambda function for automated response to GuardDuty findings. However, the Lambda function is not triggered for new findings. What is the MOST likely cause?

Accepted Answer

The event pattern does not match the actual structure of GuardDuty findings.. The event pattern provided in the CloudWatch Events rule must exactly match the JSON structure of a GuardDuty finding as it is published to the default event bus. GuardDuty findings are delivered with a specific schema that includes a `detail` object containing `type`, `severity`, and other fields. If the event pattern uses incorrect field names, nesting, or missing required elements (e.g., `source` must be `aws.guardduty`), CloudWatch Events will not match the incoming events, and the Lambda function will not be triggered.

Answer

The finding type is not specified in the pattern.

Answer

CloudTrail is not enabled in the account.

Answer

The Lambda function does not have permission to be invoked by CloudWatch Events.

Question 4

An IAM policy allows a user to pass a specific role and launch EC2 instances. The user tries to launch an EC2 instance with the role 'ec2-full-access' but receives an error: 'You are not authorized to perform iam:PassRole'. What is the MOST likely cause?

Accepted Answer

The user is attempting to pass a role with an ARN that does not exactly match the one in the policy. The error 'You are not authorized to perform iam:PassRole' indicates that the IAM policy does not allow the user to pass the role. The most likely cause is that the role ARN the user is trying to pass does not exactly match the ARN specified in the policy. Option A is incorrect because if the role didn't exist, the error would be different (e.g., 'The role does not exist'). Option C is incorrect because ec2:InstanceProfile is not a condition key for PassRole; it's a resource attribute. Option D is incorrect because the error is about PassRole, not RunInstances.

Answer

The role 'ec2-full-access' does not exist in the account

Answer

The policy is missing a condition key such as ec2:InstanceProfile

Answer

The user does not have permission to call ec2:RunInstances

Question 5

A financial services company uses AWS KMS to encrypt sensitive data in S3 and RDS. The security team requires a centralized audit trail of all KMS key usage, including key creation, deletion, and cryptographic operations. The audit logs must be stored in a separate AWS account for compliance. The team has enabled CloudTrail in the management account and configured a trail that logs to an S3 bucket in the audit account. However, they notice that KMS events such as Decrypt and GenerateDataKey are not appearing in the CloudTrail logs. The KMS key policy includes the following statement: {"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::management-account:root"},"Action":"kms:*","Resource":"*"}. What is the MOST likely reason for the missing KMS events?

Accepted Answer

CloudTrail is not configured to log KMS data events.. CloudTrail does log KMS events by default, but they are data events and must be explicitly enabled. Option B is correct because KMS data events (like Decrypt and GenerateDataKey) are not logged unless CloudTrail is configured to capture them. Option C is wrong because the key policy grants full access to the management account, so it is sufficient. Option D is wrong because cross-account access is not the issue; the trail is logging to an S3 bucket in the audit account, but that does not affect which events are logged.

Answer

The S3 bucket in the audit account does not have a bucket policy allowing writes from CloudTrail.

Answer

CloudTrail does not log KMS Decrypt and GenerateDataKey events.

Answer

The KMS key policy does not grant CloudTrail permission to log events.

Question 6

A security engineer is designing an incident response plan for a containerized application running on Amazon ECS with Fargate. The engineer needs to ensure that if a container is compromised, the incident response team can capture a memory dump and disk snapshot for forensic analysis. The containers are stateless and use ephemeral storage. Which approach provides the necessary forensic data?

Accepted Answer

Use ECS Exec to access the container and capture a memory dump; snapshot the task's ephemeral storage.. ECS Exec allows interactive access to a running container without stopping it, enabling the capture of a memory dump (e.g., via `gcore` or `/proc/kcore`). Additionally, the task's ephemeral storage can be snapshotted while the container is still running, preserving disk state for forensic analysis. This approach aligns with incident response best practices for stateless containers on Fargate, where traditional host-level forensics are unavailable.

Answer

Configure the container to stream /dev/mem to CloudWatch Logs.

Answer

Enable ECS task memory dumps to CloudWatch Logs.

Answer

Stop the task and create a new task from the same image.

Question 7

A security engineer is investigating a potential compromise. The engineer has captured a memory dump from an EC2 instance and needs to analyze it for malware. Which TWO actions should the engineer take to preserve the chain of custody? (Choose TWO.)

Accepted Answer

Record the date, time, and digital signature of the acquisition.. Recording the date, time, and digital signature of the acquisition establishes a clear audit trail, which is essential for proving that the evidence has not been tampered with. In forensic investigations, this metadata is part of the standard chain-of-custody documentation that demonstrates who collected the evidence, when, and that it remains unaltered. A digital signature (e.g., using a tool like gpg or a signed hash) provides non-repudiation and integrity verification beyond a simple hash.

Answer

Create an EBS snapshot of the instance's root volume.

Answer

Analyze the memory dump on the same EC2 instance.

Answer

Upload the memory dump to a public S3 bucket for analysis.

Question 8

A company uses Amazon S3 to store sensitive documents. They must ensure that all objects are encrypted at rest and that any attempt to upload an unencrypted object is denied. Which S3 bucket policy statement achieves this?

Accepted Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256 AND the encryption is SSE-S3.. Option C is correct because it explicitly denies PutObject unless the request includes both the x-amz-server-side-encryption header with value AES256 (which requests SSE-S3) and the encryption type is SSE-S3. This ensures only objects encrypted with SSE-S3 can be uploaded. Option A is incorrect because it only checks for the header value AES256; while AES256 is specific to SSE-S3 and would also enforce SSE-S3, Option C provides a more explicit condition. Option B is incorrect because it denies all PutObject requests. Option D is incorrect because an Allow statement cannot enforce a denial; a Deny statement is required to block unencrypted uploads.

Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256.

Answer

Deny s3:PutObject for all principals.

Answer

Allow s3:PutObject only when x-amz-server-side-encryption: AES256 is present.

Question 9

A company's security team is designing an incident response plan for AWS resources. They want to ensure that when a security incident is detected in a production account, a pre-defined runbook is executed automatically. The runbook includes steps to isolate the compromised resource and collect forensic evidence. Which combination of services should the team use to implement this automation?

Accepted Answer

AWS Systems Manager Incident Manager and AWS Systems Manager Automation. AWS Systems Manager Incident Manager provides the incident management lifecycle, including automated response plans that trigger runbooks when an incident is detected. AWS Systems Manager Automation runbooks contain predefined steps (e.g., isolating EC2 instances, capturing memory dumps, and collecting logs) that can be executed automatically. This combination directly meets the requirement for a pre-defined runbook that isolates the compromised resource and collects forensic evidence.

Answer

Amazon EventBridge and AWS Lambda

Answer

AWS Config and Amazon EC2 Auto Scaling

Answer

AWS Step Functions and AWS Lambda

Question 10

A company uses Amazon RDS for PostgreSQL with encryption at rest enabled using AWS KMS. The security team wants to ensure that database backups (automated snapshots) are also encrypted and that the encryption key can be rotated on demand without re-encrypting the data. Which approach should be taken?

Accepted Answer

Create a new KMS key and modify the RDS instance to use the new key. The existing backup will be re-encrypted with the new key when the instance is modified.. You can create a new KMS key and modify the RDS instance to use the new key. This action re-encrypts the database and its automated snapshots with the new key, providing on-demand key rotation. The re-encryption is performed automatically during the modification. Option A is incorrect because RDS does not allow specifying a separate KMS key for backups; backups use the same key as the instance. Option B is incorrect because disabling the old KMS key would break access to existing backups that are still encrypted with that key. Option C is incorrect because automatic key rotation in KMS does not trigger re-encryption of existing data; it only generates new key material for future encryption operations.

Answer

Use a separate KMS key for backups by enabling 'Copy tags to snapshots' and specifying a different key.

Answer

Disable the old KMS key and enable a new KMS key for the RDS instance. The old backup will remain encrypted with the old key.

Answer

Enable automatic key rotation in KMS and import new key material every 90 days.

Question 11

Refer to the exhibit. A user from IP 10.1.2.3 attempts to download an object from my-secret-bucket using HTTP (not HTTPS). What will be the outcome?

Accepted Answer

Failure, because the Deny statement blocks HTTP requests.. The Deny statement with condition aws:SecureTransport=false will block HTTP requests. Even though the IP matches the allow rule, the explicit Deny overrides the Allow.

Answer

Success, because the Allow statement is evaluated first.

Answer

Failure, because the user's IP is not in the allowed range.

Answer

Success, because the user's IP is within the allowed range.

Question 12

A company stores data in Amazon S3 and uses AWS KMS with Customer Master Keys (CMKs) for encryption. The security team wants to audit when the CMK is used to decrypt data. Which of the following will provide this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS Decrypt API calls, which is exactly what is needed to audit CMK decryption. Option A (AWS Config) records configuration changes, not API calls. Option B (Amazon CloudWatch Logs) can store logs but does not generate the KMS decrypt logs itself; CloudTrail generates them. Option D (S3 server access logs) record requests to S3 objects, not the KMS decryption calls that happen when accessing encrypted objects.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

S3 server access logs

Question 13

A company has enabled Amazon GuardDuty in multiple AWS accounts. The security team wants to centralize GuardDuty findings into a single account for analysis. Which THREE steps are required to achieve this? (Choose THREE.)

Accepted Answer

Invite member accounts to join the GuardDuty master account.. In Amazon GuardDuty, to centralize findings from multiple accounts, you must designate a master account and then invite member accounts to join. The invitation process establishes a trusted relationship where the master account can aggregate and analyze findings from all member accounts. Without this step, the master account cannot receive findings from other accounts.

Answer

Configure CloudWatch Logs cross-account subscription to aggregate findings.

Answer

Create an EventBridge rule to forward findings to the master account.

Question 14

A security engineer needs to enable VPC Flow Logs to capture traffic metadata. Which THREE components are required to create a VPC Flow Log?

Accepted Answer

A CloudWatch Logs log group to publish the flow logs.. A CloudWatch Logs log group is required because VPC Flow Logs publish traffic metadata to CloudWatch Logs as the default destination. The flow logs are stored as log streams within the specified log group, enabling querying and monitoring via CloudWatch Logs Insights. Without a log group, there is no destination for the flow log records to be sent to.

Answer

An S3 bucket to store the flow logs.

Answer

An Amazon Kinesis Data Firehose delivery stream.

Question 15

A company is using AWS KMS to encrypt data at rest. The security team needs to ensure that keys cannot be deleted before a retention period. Which THREE steps should be taken? (Choose three.)

Accepted Answer

Enable AWS CloudTrail to log key deletion events.. Options A, B, and E are correct. Enabling CloudTrail to log key deletion events helps audit attempts. Setting CloudWatch alarms on kms:ScheduleKeyDeletion events provides notification. Scheduling key deletion with a waiting period (e.g., 7 days) implements a retention period. Option C is incorrect because IAM policies can prevent deletion but do not enforce a retention period; the question asks to ensure keys cannot be deleted before a retention period, which requires a waiting period, not just denial. Option D is incorrect because automatic rotation does not prevent deletion.

Answer

Create an IAM policy that denies kms:ScheduleKeyDeletion.

Answer

Enable automatic key rotation.

Question 16

A company uses AWS KMS to encrypt objects in an S3 bucket. The security team wants to ensure that only users with the appropriate KMS key permissions can decrypt objects. Which TWO conditions should be included in the S3 bucket policy to enforce this? (Choose TWO.)

Accepted Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}. Options A and E are the only distinct conditions that can be used in an S3 bucket policy to enforce that only users with appropriate KMS key permissions can decrypt objects. kms:ViaService restricts the use of the KMS key to requests coming via the S3 service, and kms:EncryptionContext restricts decryption to requests that include the specific S3 bucket ARN. Option C is identical to A and thus does not provide an additional constraint, making it redundant. Options B and D are not valid condition keys for S3 bucket policies.

Answer

"Condition": {"StringEquals": {"kms:KeySpec": "SYMMETRIC_DEFAULT"}}

Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}

Answer

"Condition": {"StringEquals": {"kms:GranteePrincipal": "arn:aws:iam::123456789012:role/Admin"}}

Question 17

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains a web server that needs to be patched via the internet. The security engineer has configured the route tables: the public subnet route table has a default route to the Internet Gateway, and the private subnet route table has a default route to the NAT gateway. The web server can successfully initiate outbound connections to the internet to download patches. However, the security team notices that the web server is also receiving inbound connections from the internet on port 80. The web server's security group allows inbound HTTP from 0.0.0.0/0. What should the engineer do to prevent inbound internet traffic while still allowing outbound patching?

Accepted Answer

Modify the web server's security group to remove the inbound HTTP rule from 0.0.0.0/0.. Removing the inbound HTTP rule from the security group will block inbound traffic from the internet, while outbound traffic is still allowed because security groups are stateful and allow return traffic for outbound-initiated connections. Option A is incorrect because changing the route table would break outbound connectivity. Option C is incorrect because the NAT gateway already handles outbound traffic; changing it would not help. Option D is incorrect because a network ACL would affect all traffic and could block return traffic for outbound connections.

Answer

Change the private subnet's route table to have a default route to the Internet Gateway instead of the NAT gateway.

Answer

Replace the NAT gateway with a NAT instance and configure it to block inbound traffic.

Answer

Add a network ACL to the private subnet that denies inbound HTTP traffic.

Question 18

An organization has a requirement to retain all AWS CloudTrail logs for at least 7 years for compliance. Currently, logs are stored in an S3 bucket with default settings. What is the MOST cost-effective way to meet the retention requirement?

Accepted Answer

Configure S3 lifecycle policy to transition objects to S3 Glacier after 30 days and expire after 7 years.. The most cost-effective because it uses an S3 lifecycle policy to transition objects to S3 Glacier after 30 days (reducing storage costs for older logs) and then expires (deletes) them after 7 years to meet the retention requirement. Option A is wrong because storing logs directly in S3 Glacier Deep Archive is not cost-effective for logs that may be accessed occasionally and does not automatically expire after 7 years without additional policy. Option B is wrong because simply deleting after 7 years does not take advantage of cheaper storage tiers. Option C is wrong because CloudTrail trails do not have a retention setting; retention must be managed via S3 lifecycle policies.

Answer

Use S3 Glacier Deep Archive immediately.

Answer

Set an S3 lifecycle policy to delete objects after 7 years.

Answer

Set the CloudTrail trail to store logs in an S3 bucket with 7-year retention.

Question 19

An organization uses AWS Organizations and wants to restrict the use of specific EC2 instance types across all member accounts. Which policy type should be used to enforce this restriction?

Accepted Answer

Service control policy (SCP). Service control policies (SCPs) are used in AWS Organizations to centrally control permissions for all accounts in the organization. SCPs allow you to restrict the maximum permissions for member accounts, including denying specific EC2 instance types. Resource-based policies are attached to resources, not accounts, and cannot enforce account-wide restrictions. IAM policies are applied to users/roles but can be overridden by administrators unless bounded by SCPs. CloudFormation policies are for stack resources and do not apply across accounts.

Answer

Resource-based policy

Answer

IAM policy

Answer

AWS CloudFormation policy

Question 20

A security engineer notices that an IAM user has been performing suspicious actions in an AWS account. The engineer needs to generate a credential report to identify the age of the user's access keys. Which AWS CLI command should the engineer run?

Accepted Answer

aws iam generate-credential-report && aws iam get-credential-report. The engineer must first generate the credential report using 'aws iam generate-credential-report' and then retrieve it with 'aws iam get-credential-report'. The report contains the age of access keys. Option A is incorrect because 'get-account-authorization-details' retrieves information about account entities, not credential age. Option C is incorrect because 'generate-service-last-accessed-details' is used to find out which services an IAM entity has accessed, not key age. Option D is incorrect because 'list-access-keys' lists keys but does not provide the key age; the credential report includes creation dates.

Answer

aws iam get-account-authorization-details

Answer

aws iam generate-service-last-accessed-details

Answer

aws iam list-access-keys --user-name suspectUser