SCS-C02 Timed Practice Test 3 — 10 Questions

Question 1

A company uses AWS Organizations to manage multiple accounts. The security team wants to enable CloudTrail for all accounts and centrally store logs. What is the most efficient way to achieve this?

Accepted Answer

Create a CloudTrail trail in the management account and apply it to all accounts in the organization. AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts within the organization. This is the most efficient method as it eliminates the need for manual per-account configuration or custom automation, and it ensures consistent logging across the entire organization with centralized log delivery to a single S3 bucket.

Answer

Use an S3 bucket policy to allow cross-account log delivery

Answer

Use AWS Lambda to create trails in each account

Answer

Ask each account admin to create their own CloudTrail trail and deliver to a central S3 bucket

Question 2

Which TWO are valid ways to authenticate an IAM user?

Accepted Answer

Password. Option C (Password) is correct because an IAM user with console access authenticates to the AWS Management Console using a user name and password, which is the standard sign-in credential for interactive console sessions. Option E (Access keys, i.e., access key ID and secret access key) is correct because programmatic requests to AWS APIs, CLI, and SDKs are signed with an access key ID and secret access key pair tied to the IAM user. Option A (SSL/TLS certificate) is not a valid IAM user authentication method; X.509 certificates are used for signing SOAP requests in limited legacy scenarios, not as a general IAM user credential. Option B (MFA token) is not a standalone authentication method — it is a second factor used in addition to a password or access key, not a primary credential by itself. Option D (SSH key pair) is not an IAM authentication mechanism; SSH keys are used for logging into EC2 instances (e.g., via CodeCommit or instance access), not for authenticating to AWS as an IAM user.

Answer

SSL/TLS certificate

Answer

MFA token

Answer

SSH key pair

Question 3

A security engineer is troubleshooting an issue where CloudTrail logs are not being delivered to the specified S3 bucket. The bucket policy allows CloudTrail to write objects. What is the MOST likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies access to the CloudTrail service principal.. The most likely cause is that the S3 bucket policy explicitly denies access to the CloudTrail service principal. Even if a bucket policy allows CloudTrail to write logs, an explicit deny statement overrides any allow, preventing log delivery. This is a common misconfiguration where a deny rule is inadvertently applied to the CloudTrail principal.

Answer

The S3 bucket uses server-side encryption with customer-provided keys (SSE-C).

Answer

The S3 bucket does not have versioning enabled.

Answer

The S3 bucket is in a different AWS account.

Question 4

A company uses AWS CloudHSM to generate and store encryption keys for a custom application. The security team is concerned about key durability and wants to ensure that keys are not lost if the HSM fails. Which action should be taken?

Accepted Answer

Regularly back up the HSM to an Amazon S3 bucket and restore to a new cluster if needed. AWS CloudHSM supports taking backups of the HSM content to an Amazon S3 bucket. These backups can be used to restore to a new HSM cluster in case of failure, ensuring key durability. Option A is incorrect because CloudHSM clusters are single-region; multi-region clusters are not supported. Option B is incorrect because storing keys on an encrypted EBS volume bypasses the security of the HSM and is not a recommended practice for key durability. Option C is incorrect because AWS KMS cannot directly import keys from CloudHSM; KMS and CloudHSM are separate services with different key management capabilities.

Answer

Create a multi-region CloudHSM cluster

Answer

Store the keys in a file on an encrypted EBS volume

Answer

Use AWS KMS to import the keys from CloudHSM

Question 5

A security engineer is designing a system to allow an EC2 instance to write logs to an S3 bucket. Which TWO steps are required?

Accepted Answer

Add a bucket policy that allows the IAM role to perform s3:PutObject.. Options C and D are correct. The EC2 instance needs an IAM role with permissions to write to the bucket (D), and the bucket policy must allow the role to write (C). Option A is incorrect because a security group controls network traffic but does not grant IAM permissions. Option B is incorrect because a VPC endpoint provides private connectivity but is not required for this task. Option E is incorrect because CloudTrail is for API logging, not application logs.

Answer

Configure the security group of the EC2 instance to allow outbound HTTPS traffic to S3.

Answer

Create a VPC endpoint for S3 in the same subnet as the EC2 instance.

Answer

Enable AWS CloudTrail to capture log write events.

Question 6

Refer to the exhibit. A security engineer is investigating a potential unauthorized VPC creation. What does the evidence suggest?

Accepted Answer

The user admin created two VPCs, but one was deleted shortly after creation.. The CloudTrail log shows two CreateVpc events by user admin. One VPC exists (vpc-12345678), but the other (vpc-87654321) does not exist, indicating that it was deleted after creation. This could indicate malicious activity where a VPC was created and then deleted to cover tracks.

Answer

The CloudTrail log is incomplete; both VPCs exist.

Answer

Both VPCs were created successfully and still exist.

Answer

The user admin only created one VPC; the second event is a duplicate.

Question 7

A security engineer needs to audit all API calls made in an AWS account for the past 90 days. Which AWS service should the engineer use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (Option B) is the correct service for auditing all API calls made in an AWS account over the past 90 days. It records API activity and can be configured to store logs for 90 days in the management event history. Option A (Amazon S3 access logs) logs access to S3 objects, not API calls. Option C (AWS Config) tracks resource configuration changes, not API calls. Option D (Amazon CloudWatch Logs) is for monitoring, storing, and accessing log files from various sources, but it is not specifically designed for auditing API calls; CloudTrail is the primary service for that purpose.

Answer

Amazon S3 access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 8

A security engineer is reviewing AWS CloudTrail logs and notices a large number of `DescribeInstances` API calls from a single IAM user in a short period. The engineer suspects a credential compromise. What is the most effective way to automatically revoke the compromised credentials and notify the security team?

Accepted Answer

Create an Amazon EventBridge rule that triggers an AWS Lambda function to revoke the keys and send an SNS notification.. It uses Amazon EventBridge to detect the anomalous DescribeInstances API calls (via CloudTrail as an event source), then triggers an AWS Lambda function to programmatically revoke the IAM user's access keys (using the `deactivate_access_key` or `delete_access_key` API), and sends an SNS notification to the security team. This provides an automated, near-real-time response to a suspected credential compromise without manual intervention.

Answer

Use AWS CloudTrail to automatically disable the IAM user's access keys.

Answer

Create an AWS Config rule that checks for excessive API calls and revokes keys.

Answer

Enable Amazon GuardDuty to automatically revoke compromised credentials.

Question 9

A security engineer is investigating a potential incident where an EC2 instance was compromised. The engineer has access to the following logs: CloudTrail, VPC Flow Logs, and OS-level logs from the instance. Which TWO log sources would be MOST useful to determine the initial attack vector? (Choose TWO.)

Accepted Answer

OS-level authentication and system logs. OS-level authentication and system logs (option B) are critical because they record local login attempts, sudo commands, and process executions that can reveal how an attacker gained initial access—such as via SSH brute force, a compromised user account, or a vulnerable service. CloudTrail logs (option C) are equally important because they capture API calls made to AWS services, including RunInstances, CreateKeyPair, and ModifySecurityGroup, which can show if the attacker launched the instance from a compromised AWS account or modified security groups to allow inbound traffic. Together, these two sources provide the evidence needed to trace the initial compromise vector, whether it originated from within the OS or through AWS API manipulation.

Answer

Amazon CloudWatch Metrics for the instance

Answer

AWS Config configuration history

Answer

VPC Flow Logs

Question 10

Refer to the exhibit. An IAM policy is attached to a group. A user in the group accesses the S3 bucket from an IP address 203.0.113.5 using HTTPS. What will be the result?

Accepted Answer

The user will be denied access because the source IP is not in the allowed ranges.. The IAM policy includes a condition that restricts access to only the IP ranges 192.0.2.0/24 and 198.51.100.0/24. The user's IP address 203.0.113.5 does not fall within these ranges, so access is denied. Option B is incorrect because an Allow with conditions does not grant access by default; all conditions must be satisfied. Option C is incorrect because the policy does explicitly allow the s3:GetObject action, but only under the specified conditions. Option D is incorrect because while SecureTransport is satisfied, the IP condition is not met, and all conditions must be true for the Allow to take effect.

Answer

The user can access objects because an Allow with conditions grants access by default.

Answer

The user will be denied access because the policy does not allow the action explicitly.

Answer

The user can access objects because the condition for SecureTransport is met.