SCS-C02 Multiple Select — 40 Questions

Question 1

Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)

Accepted Answer

Enable DNS query logging and publish to CloudWatch Logs.. Amazon GuardDuty relies on DNS query logs to detect suspicious domain name resolution patterns, such as DNS tunneling or communication with known malicious domains. By enabling DNS query logging and publishing to CloudWatch Logs, GuardDuty can ingest this data as a source for its threat detection algorithms. Without DNS logs, GuardDuty cannot analyze DNS-based attack vectors within the VPC.

Answer

Enable CloudTrail data events for S3.

Answer

Enable S3 server access logs.

Answer

Enable AWS Config configuration history.

Question 2

A security engineer is configuring AWS Config to track changes to security groups in a VPC. The engineer wants to be notified when a security group is modified. Which TWO steps are required to achieve this?

Accepted Answer

Configure an SNS topic and subscribe to it to receive notifications when the Config rule triggers.. Options A and D are correct. To monitor security group changes with AWS Config, you need to create an AWS Config rule (option D) that tracks changes to security groups. To receive notifications when the rule triggers, you configure an SNS topic and subscribe to it (option A). Option B is incorrect because AWS CloudTrail logs API calls to security groups, but Config itself monitors resource configuration changes without requiring CloudTrail. Option C is incorrect because Amazon GuardDuty is a threat detection service, not a configuration change monitor. Option E is incorrect because VPC Flow Logs capture network traffic, not configuration changes. The common pitfall is assuming CloudTrail or GuardDuty is necessary, but Config's built-in change tracking suffices.

Answer

Enable AWS CloudTrail to log security group changes.

Answer

Enable Amazon GuardDuty to detect security group modifications.

Answer

Enable VPC Flow Logs to capture security group activity.

Question 3

A company uses AWS KMS to encrypt objects in an S3 bucket. The security team wants to ensure that only users with the appropriate KMS key permissions can decrypt objects. Which TWO conditions should be included in the S3 bucket policy to enforce this? (Choose TWO.)

Accepted Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}. Options A and E are the only distinct conditions that can be used in an S3 bucket policy to enforce that only users with appropriate KMS key permissions can decrypt objects. kms:ViaService restricts the use of the KMS key to requests coming via the S3 service, and kms:EncryptionContext restricts decryption to requests that include the specific S3 bucket ARN. Option C is identical to A and thus does not provide an additional constraint, making it redundant. Options B and D are not valid condition keys for S3 bucket policies.

Answer

"Condition": {"StringEquals": {"kms:KeySpec": "SYMMETRIC_DEFAULT"}}

Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}

Answer

"Condition": {"StringEquals": {"kms:GranteePrincipal": "arn:aws:iam::123456789012:role/Admin"}}

Question 4

A company stores sensitive data in Amazon S3. The security team needs to ensure that data is encrypted at rest and that access is logged. Which TWO actions meet these requirements?

Accepted Answer

Enable S3 server access logs. (Enable S3 server access logs) and Option D (Enable default encryption on the S3 bucket) are correct. Default encryption ensures data is encrypted at rest. Server access logs record requests to the bucket. Option A is wrong because VPC Flow Logs capture network traffic, not S3 access. Option C is wrong because CloudTrail logs data events only if explicitly enabled. Option E is wrong because IAM Access Analyzer analyzes resource policies, not logging access.

Answer

Enable VPC Flow Logs for the VPC

Answer

Enable AWS CloudTrail to log data events

Answer

Enable AWS IAM Access Analyzer

Question 5

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Accepted Answer

Amazon CloudWatch Logs with S3 access log analysis.. Amazon CloudWatch Logs can ingest and analyze S3 access logs, which record detailed information about requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. By analyzing these logs with CloudWatch Logs Insights or metric filters, you can detect large data transfers to external IPs and trigger alerts via CloudWatch Alarms, making it a valid detection and alerting mechanism for data exfiltration.

Answer

AWS Config with compliance rules.

Answer

VPC Flow Logs.

Question 6

A Security Engineer is configuring a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. Which TWO actions should the Engineer take to allow the web server internet access without exposing the database to the internet?

Accepted Answer

Create a NAT Gateway in the public subnet.. A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections from the internet. By adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway, the web server's outbound traffic is forwarded to the NAT Gateway, which then uses the Internet Gateway to reach the internet. The database remains isolated because it has no direct route to the Internet Gateway and no public IP address.

Answer

Create a bastion host in the public subnet and configure the web server to use it as a proxy.

Answer

Create a VPC endpoint for Amazon S3.

Answer

Attach an Internet Gateway to the VPC and add a route to the Internet Gateway in the private subnet's route table.

Question 7

Which TWO AWS services can be used to monitor and audit data access patterns to Amazon S3 buckets? (Choose 2.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is correct because it records API activity for Amazon S3, including data-level events such as GetObject, PutObject, and DeleteObject. By enabling data events on a trail, you can capture who accessed which object, from which IP address, and when, providing a complete audit trail for data access patterns.

Answer

AWS Config

Answer

AWS CloudWatch

Answer

AWS Trusted Advisor

Question 8

A company is using Amazon GuardDuty to detect threats. The security team wants to receive alerts for specific findings. Which TWO AWS services can be used to forward GuardDuty findings to a custom application for analysis? (Choose two.)

Accepted Answer

Amazon CloudWatch Events (Amazon EventBridge). Amazon GuardDuty can publish findings to Amazon CloudWatch Events (now part of Amazon EventBridge) as events. These events can then be routed to a custom application via targets like AWS Lambda, SQS, or Kinesis, enabling real-time analysis and alerting. This is the primary, native integration for forwarding GuardDuty findings to downstream systems.

Answer

Amazon Kinesis Data Streams

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Lambda

Question 9

A company is designing a disaster recovery plan for encrypted Amazon EBS volumes. Which THREE steps are required to ensure that encrypted EBS snapshots can be restored in a different AWS Region?

Accepted Answer

Copy the encrypted snapshot to the target AWS Region. To restore encrypted EBS snapshots in a different AWS Region, you must copy the encrypted snapshot to the target region (B) and ensure the customer managed key (CMK) used for encryption is available in the target region (D). Re-encrypting the snapshot with a CMK in the target region (A) is optional if you want to use a different key, but it is not a required step. Options C and E are incorrect because AWS CloudHSM is not used for EBS encryption and sharing snapshots via AWS RAM does not guarantee key availability.

Answer

Re-encrypt the snapshot with a customer managed key (CMK) in the target region

Answer

Store the encryption key in AWS CloudHSM in the target region

Answer

Share the snapshot with the target region using AWS RAM

Question 10

Which TWO steps should a security engineer take when responding to a confirmed security incident involving a compromised EC2 instance? (Choose 2.)

Accepted Answer

Isolate the instance by changing its security group to deny all traffic. Isolating the compromised EC2 instance by changing its security group to deny all traffic immediately stops the attack in progress and prevents lateral movement to other resources, while preserving the instance for forensic analysis. This aligns with the AWS incident response best practice of containment before eradication, as the instance remains intact for investigation.

Answer

Reimage the instance from a clean AMI immediately

Answer

Delete all CloudTrail logs related to the instance

Answer

Immediately terminate the instance to stop the attack

Question 11

A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)

Accepted Answer

An internet gateway attached to the VPC.. An internet gateway (IGW) is required to enable outbound internet access for resources in a VPC. The NAT gateway, which resides in a public subnet, uses the IGW to translate private IP addresses to the public IP of the NAT gateway, allowing instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet.

Answer

AWS WAF attached to the NAT gateway.

Answer

A VPC gateway endpoint for S3.

Question 12

A company is implementing a security monitoring solution for its AWS environment. Which TWO services can be used to detect and alert on suspicious API activity? (Choose TWO.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including suspicious API activity. It analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to generate security findings and alerts. GuardDuty uses machine learning and anomaly detection to identify patterns such as unusual API calls, credential compromise, or reconnaissance attempts, making it a correct choice for detecting and alerting on suspicious API activity.

Answer

Amazon Inspector

Answer

AWS Config

Answer

VPC Flow Logs

Question 13

A company is designing a secure data sharing solution with a third party. The company needs to share sensitive files stored in an S3 bucket with the third party, ensuring that the files are encrypted at rest and in transit, and that the third party can only access specific files. The company also wants to rotate the access credentials every 30 days. Which TWO actions should the company take? (Select TWO.)

Accepted Answer

Configure an S3 bucket policy that denies access unless the request includes a specific KMS key ID.. Options C and E are correct. Option C uses an S3 bucket policy with a condition requiring requests to include a specific KMS key ID, ensuring that only requests using that key can access the objects. This enforces encryption at rest (objects encrypted with that key) and in transit (HTTPS with KMS). Option E grants the third party's AWS account permission to use that KMS key for decrypt operations, allowing them to decrypt the files. Together, they provide encryption key control and the ability to rotate the key or its policy every 30 days. Option A (cross-account IAM role) does not enforce encryption key control and requires the third party to assume a role, but credential rotation is managed via role trust policy, not directly. Option B (S3 Cross-Region Replication) replicates objects but does not enforce key-specific access or encryption at rest in the destination. Option D (presigned URLs) provides time-limited access but does not enforce encryption key control and cannot be easily rotated every 30 days without regenerating URLs.

Answer

Create an IAM role in the company's account that the third party can assume, and attach a policy that grants access to the specific files.

Answer

Use S3 Cross-Region Replication to replicate the files to a bucket in the third party's account.

Answer

Generate presigned URLs for the specific files and email them to the third party.

Question 14

A company needs to protect data in Amazon S3 by ensuring that only authorized users can access objects, and all access is logged. Which TWO services should be used together? (Choose TWO.)

Accepted Answer

AWS Identity and Access Management (IAM). AWS Identity and Access Management (IAM) is correct because it enables you to define granular permissions for S3 objects, ensuring that only authorized users or roles can access them via IAM policies or S3 bucket policies. AWS CloudTrail is correct because it logs all API calls made to S3, including object-level operations like GetObject and PutObject, providing an audit trail for access. Together, they satisfy the requirement of controlling access and logging all access.

Answer

AWS KMS

Answer

AWS WAF

Answer

Amazon CloudWatch

Question 15

A developer wants to allow an IAM role to be assumed by an EC2 instance that is part of an Auto Scaling group. Which TWO AWS services or features are required? (Choose TWO.)

Accepted Answer

Instance profile. An instance profile is required to attach an IAM role to an EC2 instance. When an EC2 instance is launched with an instance profile, the AWS credentials provider on the instance can retrieve temporary security credentials from the IAM role via the instance metadata service (IMDS). This allows the instance to assume the role and perform authorized API actions without embedding long-term credentials.

Answer

AWS Config

Answer

AWS CloudFormation

Answer

AWS Single Sign-On (SSO)

Question 16

Which TWO AWS services provide native integration with Amazon CloudWatch Logs for real-time monitoring of application logs? (Choose TWO.)

Accepted Answer

Amazon EC2. Amazon EC2 is correct because it can be configured to send application logs to CloudWatch Logs via the CloudWatch Logs agent or unified CloudWatch agent, enabling real-time monitoring, search, and alerting on log data. AWS Lambda is correct because it natively integrates with CloudWatch Logs: every Lambda function execution automatically streams its logs to a CloudWatch Logs group, providing real-time visibility into function output and errors.

Answer

Amazon S3

Answer

Amazon Route 53

Answer

AWS CloudTrail

Question 17

A security team wants to detect and alert on potential security threats such as compromised instances or malicious activity within their AWS environment. Which TWO AWS services should be used together to provide comprehensive threat detection?

Accepted Answer

AWS Security Hub. Amazon GuardDuty (Option E) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence feeds. AWS Security Hub (Option A) aggregates findings from GuardDuty and other services, applies automated compliance checks, and enables centralized alerting and response. Together, they provide comprehensive threat detection by combining GuardDuty's raw threat detection with Security Hub's aggregation and orchestration capabilities.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config

Question 18

A company needs to protect data at rest in Amazon S3. Which THREE server-side encryption mechanisms can be used to encrypt objects stored in S3?

Accepted Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3). Server-Side Encryption with S3-Managed Keys (SSE-S3), Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS), and Server-Side Encryption with Customer-Provided Keys (SSE-C) are the three server-side encryption mechanisms for Amazon S3. Client-side encryption (option C) encrypts data before upload and is also a valid method to protect data at rest, but it is not a server-side mechanism. Option D (SSE-IAM) is not a real feature. Thus, the correct choices are A, B, and E.

Answer

Client-Side Encryption

Answer

Server-Side Encryption with IAM-Managed Keys (SSE-IAM)

Question 19

Which THREE actions should be taken when preserving forensic evidence from an EC2 instance during an incident? (Select THREE.)

Accepted Answer

Create an EBS snapshot of all volumes.. Creating an EBS snapshot preserves the exact state of the volume at the time of the incident, including any malicious files, logs, or artifacts. This snapshot can be used for offline forensic analysis without altering the original evidence. AWS recommends this as a first step in forensic acquisition to maintain chain of custody.

Answer

Reboot the instance to clear any malicious processes.

Answer

Terminate the instance to prevent further compromise.

Question 20

A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Configure the target group to use HTTPS protocol.. Configuring the target group to use HTTPS protocol ensures that traffic between the Application Load Balancer (ALB) and the EC2 instances is encrypted in transit. This enforces TLS encryption on the backend connection, meeting the requirement for data-in-transit protection between the ALB and instances.

Answer

Enable encryption at rest on the EC2 instances.

Answer

Use a network load balancer instead of an ALB.

Answer

Assign a certificate from ACM to the ALB listener.