Courseiva

AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 1–75

376 questions total · 6pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 6

Page 2
1
MCQhard

A large enterprise uses AWS Organizations to manage multiple accounts. The security team has implemented a Service Control Policy (SCP) at the root level that denies all actions unless the request originates from the corporate IP range (10.0.0.0/8). Recently, a developer in a member account tried to launch an EC2 instance from the AWS Management Console while connected via a VPN that provides an IP address within the corporate range. However, the launch failed with an 'AccessDenied' error. The developer is using an IAM user with full EC2 permissions (ec2:*). The SCP is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"NotIpAddress":{"aws:SourceIp":"10.0.0.0/8"}}}]}. What is the MOST likely reason for the failure?

A.The SCP allows actions only from the specified IP range, but the developer's IP is not in that range.
B.The SCP does not apply to IAM users in member accounts; it only applies to the root user.
C.The aws:SourceIp condition key does not work correctly for requests made via the AWS Management Console because the console may use a different IP.
D.The IAM user does not have the necessary permissions because the SCP explicitly denies all actions.
AnswerC

The console may use intermediary IPs; the source IP condition is not reliable for console access.

Why this answer

The SCP uses the aws:SourceIp condition, but when accessing the Management Console, the IP address seen by AWS is the console's IP, which may not be the same as the developer's VPN IP if the console uses a proxy or if the VPN is configured incorrectly. Option A is wrong because SCPs affect all principals, including the root user. Option B is wrong because the SCP denies actions, not allows them; an explicit deny overrides allows.

Option D is wrong because the SCP denies all actions, so even if the developer has permissions, the SCP denies them.

Full explanation →
2
Multi-Selecthard

Which THREE practices are recommended for managing encryption keys in AWS KMS? (Choose 3.)

Select 3 answers
A.Delete the KMS key immediately when it is no longer needed.
B.Enable automatic rotation of the KMS key annually.
C.Export the KMS key material and store it in a secure S3 bucket.
D.Use key policies to restrict which IAM roles can use the key.
E.Enable AWS CloudTrail logging to record KMS key usage.
AnswersB, D, E

Rotation helps meet compliance requirements.

Why this answer

Options B, D, and E are correct. B: Enabling automatic key rotation annually is a best practice to ensure keys are rotated regularly without manual intervention. D: Using key policies to restrict which IAM roles can use the key follows the principle of least privilege.

E: Enabling AWS CloudTrail logging to record KMS key usage provides an audit trail for security monitoring. Option A is incorrect because deleting a KMS key immediately can cause permanent data loss; instead, you should schedule key deletion. Option C is incorrect because exporting KMS key material and storing it in an S3 bucket would expose the key material and defeat the purpose of using a managed service like KMS.

Full explanation →
3
MCQhard

A security engineer notices that an S3 bucket containing sensitive data has been accessed from an IP address outside the allowed range. CloudTrail logs show the access was made using temporary credentials from an assumed role. What additional logging is needed to trace the access back to the original IAM user who assumed the role?

A.Enable CloudTrail to log data events for the S3 bucket.
B.Enable VPC Flow Logs for the VPC where the request originated.
C.Configure CloudWatch Logs to capture the EC2 instance's system logs.
D.Enable S3 server access logging for the bucket.
E.Enable AWS Config to record S3 bucket policies.
AnswerE

AWS Config does not record API calls; CloudTrail already records the session issuer in management events.

Why this answer

The information needed to trace the access back to the original IAM user who assumed the role is already available in CloudTrail management events, which are enabled by default. The AssumeRole API call is logged as a management event and includes the ARN of the IAM user or role that performed the assumption. Therefore, no additional logging is required to identify the original user.

Options A, B, C, D, and E do not provide this specific information: A and D log the S3 access but show only the assumed role; B and C are unrelated; E records configuration changes but not the specific AssumeRole call.

Exam trap

Candidates may assume that data events (A) or S3 server access logs (D) will capture the original user, but they only log the assumed role's ARN. The key is recognizing that management events already contain the AssumeRole call with the original user identity.

How to eliminate wrong answers

Option A is wrong because CloudTrail data events for S3 would log the API calls made to the bucket (e.g., GetObject, PutObject) but would still show the assumed role's ARN, not the original IAM user who assumed the role. Option B is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) but do not include IAM user or role information, so they cannot trace back to the original user. Option C is wrong because EC2 instance system logs (e.g., /var/log/messages) capture OS-level events, not AWS IAM role assumption details, and are irrelevant to tracing the original IAM user.

Option D is wrong because S3 server access logs record requests to the bucket (e.g., requester, IP, operation) but the requester field will show the assumed role's ARN, not the original IAM user who assumed the role.

Full explanation →
4
MCQeasy

A developer has created an S3 bucket policy that grants public read access. The security team wants to prevent any S3 bucket from becoming public. Which AWS service can enforce this restriction across all accounts?

A.AWS CloudTrail with a metric filter
B.S3 Block Public Access settings on each account
C.A service control policy (SCP) denying s3:PutBucketPolicy
D.IAM permissions boundary
AnswerC

SCPs can deny actions across all accounts in an organization.

Why this answer

A service control policy (SCP) is the correct choice because it operates at the AWS Organizations level to centrally restrict permissions across all accounts. By creating an SCP that denies the s3:PutBucketPolicy action, you prevent any account in the organization from modifying bucket policies to grant public access, regardless of individual account settings. This enforces a guardrail that cannot be overridden by account administrators.

Exam trap

The trap here is that candidates often confuse preventive controls (like SCPs) with detective controls (like CloudTrail) or assume that S3 Block Public Access settings applied per account are sufficient for centralized enforcement, but SCPs are the only service that can enforce restrictions across all accounts in an organization from a single point.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail with a metric filter only monitors and alerts on API calls (e.g., s3:PutBucketPolicy) but does not prevent the action from occurring; it is a detective control, not a preventive one. Option B is wrong because S3 Block Public Access settings must be configured on each account individually and can be disabled by account administrators, so they do not enforce a restriction across all accounts from a central point. Option D is wrong because IAM permissions boundaries limit the maximum permissions for IAM users or roles but do not apply to the root user or to service-linked roles, and they cannot prevent bucket policy changes made by an account administrator with full control.

Full explanation →
5
Multi-Selecthard

A security engineer wants to detect and alert on AWS account root user activity. Which THREE services can be used together to achieve this? (Select THREE.)

Select 3 answers
A.AWS Config
B.Amazon CloudWatch Events (EventBridge)
C.AWS CloudTrail
D.Amazon CloudWatch Logs
E.Amazon GuardDuty
AnswersB, C, D

CloudWatch Events can filter and alert on root user events.

Why this answer

Amazon CloudWatch Events (EventBridge) is correct because it can be used to create a rule that matches specific API calls recorded by AWS CloudTrail. When the root user performs an action, CloudTrail logs the event, and EventBridge can trigger a notification (e.g., via SNS or Lambda) based on that event. This combination allows real-time detection and alerting of root user activity.

Exam trap

The trap here is that candidates may think Amazon GuardDuty is the correct choice because it detects threats, but it does not provide a native, customizable alerting mechanism for root user activity; instead, the combination of CloudTrail, EventBridge, and CloudWatch Logs is the standard AWS-recommended approach.

Full explanation →
6
MCQmedium

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that no IAM user in any account can create new IAM users. Which approach should be used?

A.Apply an IAM policy to the root user of each account.
B.Use an SCP attached to each IAM user.
C.Use an IAM permissions boundary on each IAM user.
D.Apply a service control policy (SCP) at the root organizational unit that denies IAM:CreateUser.
AnswerD

SCPs can deny actions across all accounts in the organization.

Why this answer

Service control policies (SCPs) are the correct mechanism because they allow you to centrally restrict permissions across all accounts in an AWS Organization. By attaching an SCP at the root organizational unit that denies the `iam:CreateUser` action, you ensure that no IAM user in any member account can create new IAM users, regardless of any IAM policies applied within those accounts. SCPs act as a guardrail that overrides any allow permissions granted by IAM policies.

Exam trap

The trap here is that candidates often confuse SCPs with IAM permissions boundaries or think SCPs can be attached directly to IAM users, but SCPs only apply to accounts or organizational units and are designed for centralized governance across an AWS Organization.

How to eliminate wrong answers

Option A is wrong because the root user of each account is not subject to IAM policies; the root user has full administrative access and cannot be restricted by IAM policies. Option B is wrong because SCPs are attached to AWS accounts or organizational units, not to IAM users; attaching an SCP to an IAM user is not a valid operation. Option C is wrong because an IAM permissions boundary only limits the maximum permissions an IAM user can have, but it does not prevent the user from creating other IAM users if the boundary allows it; it is not a global deny mechanism across accounts.

Full explanation →
7
MCQmedium

A company wants to protect data at rest in Amazon S3 using client-side encryption. The application will run on Amazon EC2 instances. Which approach meets these requirements?

A.Use SSE-S3 and rely on S3 to manage keys
B.Enable S3 default encryption on the bucket
C.Use SSE-KMS with a customer managed key
D.Use the AWS Encryption SDK to encrypt data before uploading to S3
AnswerD

Client-side encryption occurs before data reaches S3.

Why this answer

Client-side encryption requires the encryption process to occur on the client side before data is uploaded to S3. The AWS Encryption SDK is designed for this purpose, allowing you to encrypt data locally on the EC2 instance using your own keys, ensuring that S3 never sees the plaintext data. This meets the requirement to protect data at rest with client-side encryption, as the data is encrypted before leaving the application environment.

Exam trap

The trap here is that candidates confuse server-side encryption options (SSE-S3, SSE-KMS) with client-side encryption, assuming that using a customer managed key (SSE-KMS) satisfies client-side requirements when it actually still encrypts data on the server side.

How to eliminate wrong answers

Option A is wrong because SSE-S3 is a server-side encryption method where S3 manages the keys and encrypts data after it is received, not client-side encryption. Option B is wrong because enabling S3 default encryption on the bucket applies server-side encryption (SSE-S3 or SSE-KMS) to objects at the time of upload, not client-side encryption. Option C is wrong because SSE-KMS with a customer managed key is still server-side encryption; the encryption happens on the S3 side after the data is transmitted, not on the client side.

Full explanation →
8
MCQhard

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application processes sensitive customer data. The Security team has enabled VPC Flow Logs, CloudTrail, and GuardDuty. Recently, the team received a GuardDuty finding indicating a potential SSH brute force attack originating from an external IP address 203.0.113.50 targeting one of the EC2 instances. The Security Engineer needs to automatically isolate the affected instance and capture forensic evidence for analysis. The company has strict requirements: the instance must be isolated immediately, and a snapshot of the EBS volume must be taken before any remediation actions are taken. The instance is part of an Auto Scaling group, and the Security Engineer wants to minimize manual intervention. The Security Engineer has access to AWS Systems Manager and AWS Lambda. Which combination of steps should the Security Engineer implement to meet the requirements?

A.Use AWS Systems Manager to automatically connect to the instance via EC2 Instance Connect, run commands to capture forensic data, and then modify the security group to deny all inbound traffic.
B.Create a CloudWatch Logs metric filter on the VPC Flow Logs for the attacker IP. When the metric breaches a threshold, trigger an SNS topic that runs an AWS Systems Manager Automation document to isolate the instance and take an EBS snapshot.
C.Configure Amazon EventBridge to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function first calls the EC2 CreateSnapshot API to capture a forensic snapshot of the instance's EBS volume. Then, it uses AWS Systems Manager Automation to run a pre-defined automation document that isolates the instance by modifying the instance's security group to only allow traffic from a trusted management IP, and then stops the instance.
D.Configure a CloudWatch Events rule to detect the GuardDuty finding and invoke an AWS Lambda function. The Lambda function terminates the EC2 instance and then takes a snapshot of the EBS volume for forensic analysis.
AnswerC

This is the correct automated response because Amazon EventBridge natively receives GuardDuty findings and can invoke a Lambda function as a target. The Lambda function first calls the EC2 CreateSnapshot API, ensuring a forensic copy of the EBS volume is preserved before any state changes. Then, instead of terminating the instance, it uses AWS Systems Manager Automation with a predefined document to modify the security group to allow only the trusted management IP, and finally stops the instance—which preserves the instance for further analysis and minimizes the risk of losing evidence.

Why this answer

It uses EventBridge to directly detect the GuardDuty finding, which triggers a Lambda function that first takes an EBS snapshot (forensic capture) via the CreateSnapshot API before any remediation. Then it uses Systems Manager Automation to isolate the instance by modifying the security group to allow only a trusted management IP and stops the instance, ensuring isolation without destroying the instance. This sequence satisfies the strict requirement that a snapshot must be taken before any remediation actions, and it minimizes manual intervention by automating the entire response.

Exam trap

The trap here is that candidates may choose Option D because they think termination is the fastest way to stop the attack, but they overlook the requirement to capture forensic evidence before remediation—termination destroys the instance and prevents a proper snapshot of the running state.

How to eliminate wrong answers

Option A is wrong because it relies on EC2 Instance Connect to manually connect and run commands, which is not automated and does not ensure a snapshot is taken before isolation; modifying the security group after connecting does not guarantee the snapshot requirement is met. Option B is wrong because it uses a CloudWatch Logs metric filter on VPC Flow Logs for the attacker IP, which is an indirect detection method that may have latency and does not directly respond to the GuardDuty finding; it also does not specify taking an EBS snapshot before isolation. Option D is wrong because it terminates the EC2 instance first, which destroys the running instance and may prevent capturing volatile forensic data; the snapshot is taken after termination, violating the requirement to capture forensic evidence before remediation actions.

Full explanation →
9
MCQeasy

A security engineer is reviewing a CloudTrail log entry (exhibit). What is the most immediate security concern indicated by this event?

A.The source IP address 203.0.113.5 is from a known malicious IP range.
B.A security group rule was added allowing SSH access from any IP address.
C.The API call was made from the AWS CLI, which may indicate a compromised access key.
D.The user JohnDoe did not use multi-factor authentication (MFA) for this API call.
AnswerB

The CloudTrail event shows eventName AuthorizeSecurityGroupIngress with request parameters that add a security group ingress rule. Specifically, it opens port 22 (SSH) to 0.0.0.0/0, meaning all IPv4 addresses on the internet can attempt SSH connections to the associated EC2 instance. This is a well-known misconfiguration that exposes administrative access externally and is the correct security finding to investigate.

Why this answer

The CloudTrail log shows an AuthorizeSecurityGroupIngress API call that added a security group rule with the CIDR 0.0.0.0/0 for port 22 (SSH). This effectively opens SSH access to the entire internet, creating a severe exposure that could allow any attacker to attempt brute-force or credential-stuffing attacks against any EC2 instance associated with that security group. This is the most immediate security concern because it directly introduces a wide-open attack surface.

Exam trap

The trap here is that candidates focus on the user identity or authentication details (like MFA or CLI usage) instead of recognizing that the actual API action—opening SSH to 0.0.0.0/0—is the most immediate and dangerous security concern.

How to eliminate wrong answers

Option A is wrong because the source IP 203.0.113.5 is a TEST-NET-1 address (RFC 5735) reserved for documentation and examples, not a known malicious IP range; real CloudTrail logs would show a routable IP. Option C is wrong because the event source is 'ec2.amazonaws.com' and the user agent indicates the AWS Management Console, not the AWS CLI; a CLI call would show 'aws-cli' or 'botocore' in the user agent field. Option D is wrong because while MFA is a best practice, the absence of MFA alone is not the most immediate concern—the critical issue is the actual security group rule change that opens SSH to the world, not the authentication method used for the API call.

Full explanation →
10
MCQeasy

A security engineer notices that an Amazon S3 bucket has been accessed from an IP address outside the company's allowed range. The engineer needs to identify the IAM user who made the request. Which AWS service should be used to find this information?

A.S3 server access logs
B.AWS CloudTrail
C.VPC Flow Logs
D.Amazon CloudWatch Logs
AnswerB

CloudTrail captures management-plane and (with data events) object-level API calls. Each event includes the IAM user, role, or federated user that made the request, along with source IP, access key, timestamp, and request/response details. For S3, enabling data events on the bucket records GetObject/PutObject with full caller identity, making it the definitive audit source for identifying which IAM principal performed an action.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to AWS services, including S3 operations, and captures the identity of the IAM user or role that made the request. By examining CloudTrail logs, the security engineer can find the specific IAM user associated with the source IP address that accessed the bucket, as CloudTrail logs include both the user identity and the source IP address for each event.

Exam trap

The trap here is that candidates often confuse S3 server access logs with CloudTrail, assuming that server access logs include IAM user details, when in fact they only log the requester's AWS account ID or anonymous access, not the specific IAM user identity.

How to eliminate wrong answers

Option A is wrong because S3 server access logs provide detailed records of requests made to an S3 bucket, including source IP and object accessed, but they do not include IAM user identity information; they only log the requester's AWS account ID or anonymous access, not the specific IAM user. Option C is wrong because VPC Flow Logs capture information about IP traffic to and from network interfaces within a VPC, but they do not log IAM user identity or API-level details; they only show network-level metadata such as source/destination IP, ports, and protocol. Option D is wrong because Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log files, but it does not generate logs itself; it can be used to store CloudTrail logs or other logs, but it is not the service that records IAM user identity for S3 API calls.

Full explanation →
11
MCQmedium

A company hosts a web application on EC2 instances behind an Application Load Balancer. The security team wants to ensure that only traffic from the ALB can reach the EC2 instances. Which configuration should be applied?

A.Configure the instances' security group to allow traffic from the ALB's security group.
B.Configure the instances' security group to allow traffic from the client's source IP addresses.
C.Configure a network ACL on the subnet to allow traffic from the ALB's private IP addresses.
D.Assign an IAM role to the instances that allows traffic only from the ALB.
AnswerA

This ensures only traffic that passes through the ALB can reach the instances.

Why this answer

Security groups support referencing other security groups as a source. By configuring the EC2 instances' security group to allow inbound traffic from the ALB's security group, only traffic originating from the ALB (which uses the ALB's security group) is permitted. This ensures that traffic from any other source, including direct internet traffic, is blocked at the instance level.

Exam trap

The trap here is that candidates often confuse network ACLs (stateless, IP-based) with security groups (stateful, group-based) and mistakenly choose option C, not realizing that security group referencing is the correct and more secure method for this scenario.

How to eliminate wrong answers

Option B is wrong because allowing traffic from client source IP addresses would permit direct access to the EC2 instances, bypassing the ALB and defeating the purpose of restricting traffic to only the ALB. Option C is wrong because network ACLs are stateless and operate at the subnet level; they cannot reference security groups and would require manual management of ALB private IP addresses, which can change over time. Option D is wrong because IAM roles control API-level permissions for AWS services, not network traffic; they cannot filter or allow inbound traffic to EC2 instances.

Full explanation →
12
Multi-Selectmedium

A security engineer is designing IAM policies for a data analytics platform that uses Amazon S3, Amazon Athena, and AWS Glue. The platform must allow data scientists to query data in S3 using Athena, but only from specific VPC subnets. Additionally, the data must be encrypted at rest using AWS KMS. Which TWO actions should the engineer take to meet these requirements? (Choose TWO.)

Select 2 answers
A.Grant kms:Decrypt permission in the IAM policy and configure the KMS key policy to allow the IAM role to use the key.
B.Add kms:EncryptionContext condition to the IAM policy to require a specific encryption context.
C.Create a VPC endpoint for Athena and attach a bucket policy that restricts access to that endpoint.
D.Use the s3:SourceIp condition key in the IAM policy to restrict access to the private IP ranges of the VPC subnets.
E.Enable default encryption on the S3 bucket using SSE-S3 and configure the KMS key policy to allow the IAM role.
AnswersA, C

Correct – Provides kms:Decrypt permission and ensures the KMS key policy allows the IAM role, enabling Athena to decrypt objects encrypted with a customer-managed KMS key.

Why this answer

A: Correct – Granting kms:Decrypt permission in the IAM policy and ensuring the KMS key policy allows the IAM role enables Athena to decrypt S3 objects encrypted with a customer-managed KMS key. C: Correct – Creating a VPC endpoint for Athena (or S3) and attaching a bucket policy that restricts access to that endpoint ensures queries are only allowed from the specified VPC subnets. B: Incorrect – The s3:SourceIp condition key does not work for requests made via VPC endpoints; use aws:SourceVpce instead.

D: Incorrect – The kms:EncryptionContext condition is not used for restricting encryption at rest; it is used for encryption context in KMS operations. E: Incorrect – SSE-S3 does not use KMS, so the KMS key policy would not be relevant.

Exam trap

A common trap is confusing VPC endpoint policies with source IP conditions. When using a VPC endpoint, you must use aws:SourceVpce in the bucket policy, not s3:SourceIp.

Full explanation →
13
MCQeasy

A security team wants to detect unauthorized API calls in real time and automatically block the source IP address using network ACLs. Which AWS service should be used for detection?

A.Amazon GuardDuty
B.AWS CloudTrail
C.AWS WAF
D.AWS Config
AnswerA

GuardDuty uses machine learning to detect suspicious API activity.

Why this answer

Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including API calls from unusual or known-bad IP addresses. It uses machine learning, anomaly detection, and integrated threat intelligence to generate findings that can trigger automated remediation, such as updating network ACLs via AWS Lambda and Amazon EventBridge. This aligns with the requirement for real-time detection and automated blocking of source IPs.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail's logging capability with real-time threat detection, overlooking that GuardDuty is specifically designed for proactive security monitoring and automated response, while CloudTrail is purely a logging and auditing service.

How to eliminate wrong answers

Option B (AWS CloudTrail) is wrong because it is an auditing service that records API call history for compliance and governance, but it does not perform real-time threat detection or generate alerts for unauthorized activity; it lacks built-in anomaly detection or threat intelligence. Option C (AWS WAF) is wrong because it is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting at the application layer, not for detecting unauthorized API calls or blocking IPs via network ACLs; it operates on HTTP/HTTPS traffic, not all API calls. Option D (AWS Config) is wrong because it is a configuration management and compliance service that evaluates resource configurations against rules, not a threat detection service; it cannot detect unauthorized API calls or trigger network ACL updates in real time.

Full explanation →
14
MCQeasy

A security engineer needs to identify which IAM users have been inactive for the past 90 days. Which AWS service should the engineer use?

A.AWS IAM Credential Report
B.Amazon CloudWatch Logs
C.AWS Config
D.AWS CloudTrail
AnswerA

The IAM Credential Report is the purpose-built tool for this task because it generates a CSV containing every IAM user in the account along with password and access key metadata, including the last-used dates. By reviewing the 'password_last_used' and 'access_key_last_used' columns, you can immediately identify users who have never signed in or never used their keys. This report can also be refreshed programmatically via AWS CLI or the IAM console, making it the most direct audit mechanism.

Why this answer

AWS IAM Credential Report is the correct service because it provides a CSV report that lists all IAM users in an account and includes the `password_last_used` and `access_key_last_used_date` fields. By examining these fields, a security engineer can determine which users have not authenticated or used their access keys for more than 90 days, directly meeting the requirement to identify inactive IAM users.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which records API calls) with the IAM Credential Report, assuming CloudTrail can directly identify inactive users, but CloudTrail logs do not aggregate per-user last activity dates and require extensive post-processing to derive inactivity, whereas the Credential Report is the purpose-built, single-source solution for this exact use case.

How to eliminate wrong answers

Option B is wrong because Amazon CloudWatch Logs is used for monitoring, storing, and accessing log files from AWS resources, but it does not natively track IAM user activity or generate reports on user inactivity; it would require custom metric filters and logs from CloudTrail to infer inactivity, which is indirect and not the intended service. Option C is wrong because AWS Config is a service for evaluating resource configurations against desired policies and tracking configuration changes, not for tracking IAM user login activity or credential usage; it lacks the specific fields like `password_last_used` needed for inactivity analysis. Option D is wrong because AWS CloudTrail records API activity for auditing, but it does not provide a consolidated report of all IAM users' last activity dates; extracting inactive users from CloudTrail logs would require complex queries across millions of events and is not the purpose-built solution for this task.

Full explanation →
15
MCQhard

A company uses AWS CloudTrail to log all API activity. They want to ensure that log files are tamper-proof and can be validated for forensic purposes. Which of the following should they enable?

A.AWS KMS server-side encryption on the S3 bucket
B.CloudTrail log file integrity validation
C.S3 bucket versioning
D.S3 Object Lock with governance mode
AnswerB

CloudTrail log file integrity validation creates a SHA-256 hash of each log file, chains that hash to the previous file's hash, and signs the resulting digest with a private key. The public key is distributed by AWS, so you can independently verify both the signature and the hash chain to detect any modification, deletion, or reordering of log files. It is the only option listed that provides cryptographic proof of log integrity.

Why this answer

CloudTrail log file integrity validation uses a SHA-256 hash chain to detect if log files have been modified, deleted, or altered after delivery. When enabled, CloudTrail delivers a digest file that includes the hash of each log file and the hash of the previous digest, creating an immutable chain that can be used to verify log integrity for forensic purposes.

Exam trap

The trap here is that candidates often confuse data protection mechanisms (encryption, versioning, object lock) with integrity validation, which specifically requires cryptographic hash verification to prove that log files have not been tampered with.

How to eliminate wrong answers

Option A is wrong because AWS KMS server-side encryption protects log files at rest from unauthorized access, but does not provide any mechanism to detect tampering or validate the integrity of the log files after they have been written. Option C is wrong because S3 bucket versioning preserves previous versions of objects, which can help recover from accidental deletion or overwrite, but it does not cryptographically verify that log files have not been altered. Option D is wrong because S3 Object Lock with governance mode prevents objects from being deleted or overwritten for a specified retention period, but it does not provide a hash-based integrity check to detect if the content of a log file was modified before being locked.

Full explanation →
16
Multi-Selecteasy

Which TWO AWS services can be used to detect anomalous API activity in an AWS account? (Choose two.)

Select 2 answers
A.Amazon GuardDuty
B.AWS CloudTrail
C.VPC Flow Logs
D.AWS Config
E.Amazon Inspector
AnswersA, B

GuardDuty detects anomalous API activity using ML.

Why this answer

Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to identify suspicious API activity. AWS CloudTrail, with the CloudTrail Insights feature, provides continuous monitoring and detection of anomalous API activity by analyzing management events and generating insights. Additionally, CloudTrail logs can be used with Amazon CloudWatch to set up metric filters and alarms for detecting unusual patterns.

Therefore, both GuardDuty and CloudTrail are valid services for detecting anomalous API activity.

Exam trap

The trap is that candidates may select VPC Flow Logs or AWS Config because they are associated with security monitoring, but they do not directly detect anomalous API activity. Additionally, some candidates might think only GuardDuty is a threat detection service and overlook that CloudTrail Insights also provides anomaly detection.

Full explanation →
17
Multi-Selectmedium

A company is using AWS KMS to encrypt data in Amazon S3. They need to ensure that the KMS key can only be used from within a specific VPC. Which TWO actions should be taken?

Select 2 answers
A.Create a VPC endpoint for AWS KMS.
B.Attach an IAM policy to the role that denies kms:Decrypt unless the request comes from the VPC.
C.Create a VPC endpoint for Amazon S3.
D.Add a bucket policy condition to restrict access to the VPC.
E.Modify the KMS key policy to include a condition on kms:SourceVpc.
AnswersA, E

Enables private connectivity to KMS from the VPC.

Why this answer

A VPC endpoint for AWS KMS allows KMS API calls to be routed through the VPC, ensuring traffic does not traverse the public internet. Option E is correct because you can modify the KMS key policy to include a condition using the kms:SourceVpc key, which restricts use of the KMS key to requests originating from the specified VPC. Option B is incorrect because IAM policies cannot directly restrict based on VPC for KMS; such restrictions must be in the key policy.

Option C is incorrect because a VPC endpoint for Amazon S3 does not restrict KMS calls. Option D is incorrect because S3 bucket policies control access to S3 objects, not KMS key usage.

Full explanation →
18
Multi-Selectmedium

A security engineer is designing a data encryption strategy for an S3 bucket that contains sensitive information. Which TWO of the following are valid options for enforcing encryption at rest?

Select 2 answers
A.Use an AWS KMS key with automatic key rotation.
B.Enable S3 default encryption on the bucket.
C.Enable AWS CloudTrail to log all object uploads.
D.Attach an IAM policy to users to require encryption.
E.Use a bucket policy to deny PutObject requests without the x-amz-server-side-encryption header.
AnswersB, E

Correct: Automatically encrypts new objects.

Why this answer

The correct options are B and E. Option B: Enabling S3 default encryption on the bucket automatically encrypts objects at rest using the specified encryption method (SSE-S3 or SSE-KMS). Option E: A bucket policy can deny PutObject requests that do not include the x-amz-server-side-encryption header, ensuring objects are uploaded with encryption enforced.

Option A is incorrect because using an AWS KMS key with automatic key rotation is a method of encryption, not an enforcement mechanism; the question asks for ways to enforce encryption at rest. Option C is incorrect because AWS CloudTrail logs API calls, not encryption enforcement. Option D is incorrect because IAM policies control user permissions but cannot directly enforce encryption at the service level; they can deny actions but encryption enforcement is typically done via bucket policies or default encryption.

Full explanation →
19
Multi-Selectmedium

A company is using AWS CloudTrail to monitor API activity in its AWS account. The security team needs to be alerted when unauthorized API calls are made to delete Amazon S3 buckets. Which TWO steps should the security team take to meet this requirement? (Choose TWO.)

Select 2 answers
A.Enable Amazon VPC Flow Logs to capture API calls and use Amazon Athena to query for DeleteBucket events.
B.Create an AWS CloudTrail trail that monitors Amazon CloudWatch Logs for DeleteBucket API calls.
C.Create an AWS Config rule to detect DeleteBucket API calls and send an SNS notification.
D.Configure CloudTrail to deliver logs to Amazon CloudWatch Logs and create a metric filter for the DeleteBucket API call.
E.Create an Amazon CloudWatch Events rule that matches the DeleteBucket API call and triggers an Amazon SNS notification.
AnswersD, E

CloudTrail can deliver to CloudWatch Logs, and a metric filter can trigger an alarm.

Why this answer

CloudTrail can be configured to deliver logs to Amazon CloudWatch Logs, and a metric filter can be created to match the `DeleteBucket` API call. This metric can then trigger an alarm that sends an SNS notification, alerting the security team to unauthorized API calls. Option E is correct because Amazon CloudWatch Events (now Amazon EventBridge) can directly match the `DeleteBucket` API call from CloudTrail and trigger an SNS notification without needing a metric filter or alarm.

Exam trap

The trap here is that candidates may confuse AWS Config (which evaluates resource configurations) with CloudTrail (which records API activity), or think VPC Flow Logs can capture API-level events instead of network flows.

Full explanation →
20
MCQhard

A company has a security rule that all S3 buckets must have server access logging enabled. A security engineer uses AWS Config to evaluate compliance. The engineer configures a managed rule but notices that the rule does not evaluate all buckets. What is the most likely reason?

A.The rule only evaluates buckets in the us-east-1 region.
B.The rule only evaluates buckets that have a specific tag.
C.The rule excludes buckets that have a bucket policy denying access to AWS Config.
D.The rule requires the logging target bucket to be in the same account.
AnswerB

The AWS Config managed rule `s3-bucket-server-access-logging-enabled` can be configured with a `tag` parameter. When a tag is specified, the rule only evaluates S3 buckets that have that exact tag. If the engineer did not apply the required tag to all buckets, or if the rule was configured with a tag that does not match all buckets, some buckets will be excluded.

Why this answer

The AWS Config managed rule `s3-bucket-server-access-logging-enabled` can be configured with a `tag` parameter. When a tag is specified, the rule only evaluates S3 buckets that have that exact tag key-value pair. If the security engineer did not apply the required tag to all buckets, or if the rule was configured with a tag that does not match all buckets, some buckets will be excluded from evaluation, causing the observed behavior.

Exam trap

The trap here is that candidates often assume AWS Config managed rules evaluate all resources of a given type by default, overlooking the fact that many rules support optional tag-based filtering that can silently limit the scope of evaluation.

How to eliminate wrong answers

Option A is wrong because the managed rule `s3-bucket-server-access-logging-enabled` evaluates buckets across all regions where AWS Config is enabled, not just us-east-1; the rule is regional in scope but can be deployed in each region. Option C is wrong because bucket policies that deny access to AWS Config would cause the rule to report a non-compliant result (e.g., 'INSUFFICIENT_DATA' or 'NON_COMPLIANT') rather than silently skip evaluation; the rule still attempts to evaluate the bucket. Option D is wrong because the rule does not require the logging target bucket to be in the same account; cross-account logging is supported as long as the necessary permissions are in place, and the rule checks the bucket's logging configuration, not the target bucket's account.

Full explanation →
21
MCQmedium

A company is using AWS CloudFormation to deploy infrastructure. The security team wants to ensure that all Amazon S3 buckets created by CloudFormation are encrypted by default. Which approach should be taken?

A.Configure an IAM policy that requires all S3 operations to use encryption.
B.Set a bucket policy in the CloudFormation template that denies all actions unless encryption is enabled.
C.Enable AWS Config rule s3-bucket-server-side-encryption-enabled to enforce encryption.
D.Use a bucket policy with a condition that denies s3:PutObject if the x-amz-server-side-encryption header is not present.
AnswerD

This policy enforces encryption on object uploads.

Why this answer

A bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to the bucket must include encryption headers. This enforces server-side encryption at the object level, which is the most direct way to guarantee encryption for all objects placed into S3 buckets created by CloudFormation.

Exam trap

The trap here is that candidates often confuse bucket-level default encryption (which can be overridden by individual requests) with object-level enforcement via bucket policy conditions, leading them to choose AWS Config rules or IAM policies that do not guarantee encryption on every object upload.

How to eliminate wrong answers

Option A is wrong because an IAM policy that requires all S3 operations to use encryption applies to the IAM user or role, not to the S3 bucket itself, and does not enforce encryption on objects uploaded by other principals or services. Option B is wrong because a bucket policy that denies all actions unless encryption is enabled would block legitimate operations that do not involve encryption headers, such as listing buckets or reading metadata, and is overly broad. Option C is wrong because an AWS Config rule like s3-bucket-server-side-encryption-enabled only checks whether the bucket has default encryption configured, but does not enforce encryption on individual object uploads, which can bypass default encryption if the request specifies otherwise.

Full explanation →
22
Multi-Selecthard

A company has a requirement that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should the company take to enforce this?

Select 2 answers
A.Enable MFA devices for each IAM user.
B.Use a service control policy (SCP) to require MFA for all users.
C.Attach an IAM policy that denies all actions unless the request includes MFA (condition aws:MultiFactorAuthPresent).
D.Enable MFA for the root user only.
E.Configure an IAM password policy that requires MFA.
AnswersA, C

Users must have MFA devices assigned.

Why this answer

To enforce MFA, each IAM user must have an MFA device enabled. Option C is correct because attaching an IAM policy with a condition that denies all actions unless aws:MultiFactorAuthPresent is true ensures that users must authenticate with MFA to perform any action. Option B is incorrect because service control policies (SCPs) are used in AWS Organizations to manage permissions across accounts, not for individual user-level MFA enforcement.

Option D is incorrect because enabling MFA for the root user only does not enforce MFA for all IAM users. Option E is incorrect because an IAM password policy controls password complexity and rotation, not MFA requirements.

Full explanation →
23
MCQmedium

A company uses S3 to store sensitive customer data. The security team requires that all objects uploaded to S3 be encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). A developer reports that some objects are being stored unencrypted. What is the MOST effective way to enforce this requirement?

A.Enable default encryption on the bucket using SSE-S3
B.Use a bucket policy to deny s3:PutObject if encryption is not set to aws:kms
C.Use an SCP to deny s3:PutObject without encryption
D.Set a bucket policy to require the x-amz-server-side-encryption header
AnswerB

Policy condition can enforce SSE-KMS.

Why this answer

A bucket policy with a Deny effect on s3:PutObject when the condition `s3:x-amz-server-side-encryption` is not equal to `aws:kms` enforces SSE-KMS for all uploads. Option A is incorrect because default encryption using SSE-S3 can be overridden by the PUT request, and it does not enforce KMS. Option C is incorrect because SCPs apply at the account or organizational unit level, not to individual buckets, and are less direct than bucket policies.

Option D is incorrect because requiring the `x-amz-server-side-encryption` header alone does not mandate the value `aws:kms`; a requester could set it to `AES256` (SSE-S3).

Full explanation →
24
MCQeasy

Refer to the exhibit. An IAM user has this policy attached. Can the user create a new IAM user in the us-east-1 region?

A.Yes, because the Allow statement explicitly permits CreateUser.
B.No, because IAM is a global service and region conditions do not apply.
C.Yes, because the Deny only applies to us-east-1.
D.No, because the Deny statement blocks all IAM actions in us-east-1.
AnswerD

The Deny is explicit and overrides the Allow.

Why this answer

The Deny statement blocks all IAM actions in us-east-1, which overrides the Allow for CreateUser. Since the Deny is explicit, it blocks the action even though there is an Allow. The request fails.

Full explanation →
25
MCQhard

A company has a requirement to retain CloudTrail logs for 7 years to meet regulatory compliance. They want to minimize storage costs while ensuring logs are immutable and cannot be deleted by anyone, including the root user. What should they do?

A.Configure the S3 bucket with MFA Delete enabled.
B.Use CloudTrail log file validation and enable AWS CloudTrail Insights.
C.Store the logs in Amazon S3 Glacier Deep Archive with a vault lock policy.
D.Enable S3 Object Lock in Compliance mode on the destination bucket.
AnswerD

Enabling S3 Object Lock in Compliance mode places a retention lock on objects until a specified date; during that retention period no user, not even the AWS account root user, can delete or overwrite them. Compliance mode is the strongest Object Lock mode because the retention protection cannot be shortened, removed, or bypassed by any principal. When used as the destination for CloudTrail logs, this guarantees the logs are retained for the full seven years and satisfies the stated requirement.

Why this answer

S3 Object Lock in Compliance mode prevents any user, including the root user, from deleting or overwriting objects for the specified retention period. This meets the immutability and retention requirements for CloudTrail logs, and by using S3 lifecycle policies to transition logs to lower-cost storage classes (e.g., S3 Glacier Deep Archive) after the initial retention period, storage costs can be minimized while maintaining compliance.

Exam trap

The trap here is that candidates may confuse S3 Glacier Vault Lock (which applies to Glacier archives, not S3 objects) with S3 Object Lock, or assume MFA Delete provides sufficient immutability, when in fact only S3 Object Lock in Compliance mode guarantees that no user, including root, can delete objects before the retention period ends.

How to eliminate wrong answers

Option A is wrong because MFA Delete only requires multi-factor authentication for delete operations but does not prevent the root user from deleting objects if they have the MFA device; it also does not enforce immutability or a fixed retention period. Option B is wrong because CloudTrail log file validation provides integrity verification (detecting tampering) but does not prevent deletion or enforce retention; AWS CloudTrail Insights is for detecting unusual activity, not for immutability or retention. Option C is wrong because S3 Glacier Deep Archive with a vault lock policy can enforce write-once-read-many (WORM) compliance, but CloudTrail logs are stored in S3 buckets, not directly in Glacier vaults; the vault lock policy applies to archives in Glacier, not to S3 objects, and transitioning logs to Glacier Deep Archive via S3 lifecycle policies does not inherently provide immutability unless combined with S3 Object Lock.

Full explanation →
26
MCQhard

A company runs a multi-account AWS environment using AWS Organizations. The security team needs to implement centralized logging for all AWS CloudTrail events across all accounts. They create a new trail in the management account with the following configuration: trail name 'central-trail', apply to all accounts in the organization, enable data events for all S3 buckets, and store logs in a centralized S3 bucket. After one week, they notice that some accounts are not delivering CloudTrail logs to the central bucket. The security engineer verifies that the trail is still configured to apply to all accounts and that the S3 bucket policy allows cross-account access. What is the MOST likely reason for the missing logs?

A.The member accounts have not enabled CloudTrail Insights
B.The S3 bucket policy does not grant the correct permissions to the member accounts
C.The trail is not configured as a multi-region trail
D.Some accounts were added to the organization after the trail was created, and the trail was not updated to include them
AnswerD

When new accounts join, the trail must be updated or they need to enable the trail manually.

Why this answer

When a trail is created in the management account with 'apply to all accounts in the organization', it automatically includes all current member accounts. However, if new accounts are added to the AWS Organization after the trail is created, the trail does not automatically extend to those new accounts. The trail must be updated (e.g., via the CloudTrail console or API) to include the newly added accounts, or the organization trail feature must be re-enabled.

This is why logs from accounts added after trail creation are missing.

Exam trap

The trap here is that candidates assume 'apply to all accounts' means the trail dynamically includes any account added later, but in reality, the trail only applies to accounts that were members at the time of creation and must be manually updated for new accounts.

How to eliminate wrong answers

Option A is wrong because CloudTrail Insights is an optional feature that analyzes management events for unusual activity; it is not required for log delivery and its absence does not prevent logs from being delivered. Option B is wrong because the security engineer already verified that the S3 bucket policy allows cross-account access, so the policy is not the issue. Option C is wrong because the question does not mention any requirement for multi-region logging; the missing logs are from specific accounts, not from specific regions, and a single-region trail would still deliver logs from the home region of each account.

Full explanation →
27
MCQmedium

A company is using AWS Organizations to manage multiple accounts. The security team needs to enforce that all newly created S3 buckets across the organization have server-side encryption (SSE-S3) enabled by default. Which solution is MOST operationally efficient?

A.Create an AWS Lambda function that is triggered by S3 event notifications to enable encryption on any new bucket.
B.Set a default bucket encryption policy in each account’s S3 console.
C.Apply an SCP to the root organizational unit that denies s3:CreateBucket if the bucket lacks encryption settings.
D.Use AWS Config with a managed rule s3-bucket-server-side-encryption-enabled to trigger remediation.
AnswerC

SCPs can deny actions with conditions, preventing noncompliant bucket creation across all accounts.

Why this answer

Applying an SCP to the root organizational unit that denies s3:CreateBucket unless encryption settings are specified is the most operationally efficient because it prevents noncompliant buckets from being created at the organizational level. Option A (Lambda triggered by S3 events) is reactive and requires ongoing management. Option B (setting default encryption per account) does not enforce across all accounts and can be overridden.

Option D (AWS Config rule with remediation) only detects and fixes noncompliant buckets after creation, which is less efficient than prevention.

Full explanation →
28
MCQmedium

A company uses AWS CloudFormation to deploy infrastructure. The security team requires that all CloudTrail trails be encrypted with a customer-managed KMS key. Which CloudFormation template snippet correctly enforces this requirement?

A.Trail with KMSKeyId set to 'aws/cloudtrail'
B.Trail with KMSKeyId set to 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-...'
C.Trail with KMSKeyId set to 'alias/my-cloudtrail-key'
D.Trail without KMSKeyId specified
AnswerB

This specifies a customer-managed KMS key.

Why this answer

It uses the full ARN of a specific customer-managed KMS key, ensuring the encryption requirement is met. Option C uses an alias, which could point to either an AWS managed key or a customer-managed key, so it does not guarantee compliance. Option A uses the AWS managed key 'aws/cloudtrail', not customer-managed.

Option D omits encryption entirely.

Full explanation →
29
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team needs to enforce that all S3 buckets in the organization block public access. Which policy should be attached to the root organizational unit to achieve this?

A.Enable AWS CloudTrail to log public access attempts and alert the security team.
B.Use AWS Config rules to remediate non-compliant buckets automatically.
C.Attach a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock.
D.Create an IAM role with a bucket policy that blocks public access.
AnswerC

SCPs can be attached to OUs to centrally restrict permissions.

Why this answer

Attach a service control policy (SCP) that denies s3:PutBucketPublicAccessBlock. SCPs can be applied at the root organizational unit to centrally restrict permissions across all accounts, preventing any account from allowing public access to S3 buckets. Option A (CloudTrail) only logs events, not block access.

Option B (AWS Config) can detect non-compliance but requires additional automation to enforce; the question asks for enforcement directly. Option D (IAM role) is account-specific and cannot enforce globally.

Full explanation →
30
MCQeasy

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the organization have multi-factor authentication (MFA) enabled. Which combination of actions should be taken to enforce this requirement?

A.Create an SCP that denies IAM actions without MFA and attach it to the IAM group that contains all users.
B.Create an SCP that denies IAM actions without MFA and attach it to the root organizational unit (OU).
C.Create an SCP that denies IAM actions without MFA and attach it to each IAM user.
D.Create an SCP that denies IAM actions without MFA and attach it to the management account.
AnswerB

Attaching the SCP to the root organizational unit places it in the hierarchy of every OU and member account in the organization, so the deny rule with aws:MultiFactorAuthPresent applies to every IAM user in those accounts. Because a root-level SCP is evaluated as an organizational permission boundary before IAM authorization, an IAM action without MFA is blocked throughout the member accounts.

Why this answer

Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to apply a blanket denial of IAM actions when MFA is not present, affecting all accounts and users within the organization. This leverages the `aws:MultiFactorAuthPresent` condition key in an SCP to enforce MFA at the organization level, ensuring that even if IAM users are created in member accounts, they cannot perform IAM actions without MFA. Attaching the SCP to the root OU ensures the policy cascades down to all child OUs and accounts, providing centralized enforcement.

Exam trap

The trap here is that candidates mistakenly think SCPs can be attached to IAM users or groups, but SCPs are organization-level policies that only apply to OUs, accounts, or the root, not to individual IAM entities.

How to eliminate wrong answers

Option A is wrong because SCPs cannot be attached to IAM groups; SCPs are applied to OUs, accounts, or the root of the organization, not to IAM entities like groups, users, or roles. Option C is wrong because SCPs cannot be attached directly to IAM users; they are only applicable to AWS Organizations entities (OUs, accounts, or the root). Option D is wrong because attaching the SCP to the management account would only affect that single account, not the member accounts; SCPs must be attached to the root OU or relevant OUs to enforce policies across the entire organization.

Full explanation →
31
MCQhard

Refer to the exhibit. A security engineer configured the above bucket policy for CloudTrail log delivery. However, logs are not being delivered. What is the most likely cause?

A.The Action should be 's3:PutObjectAcl' instead of 's3:PutObject'.
B.The Principal is incorrect; it should be the CloudTrail service principal for the region.
C.The condition requires 'bucket-owner-full-control' ACL, but CloudTrail does not set this ACL when delivering to the same account.
D.The Resource ARN is missing the account ID in the path.
AnswerC

CloudTrail sets the ACL only for cross-account delivery; for same account, the ACL is not set, causing the condition to fail.

Why this answer

When CloudTrail delivers logs to an S3 bucket in the same AWS account, it does not set the 'bucket-owner-full-control' canned ACL on the objects. The bucket policy condition requiring 's3:x-amz-acl': 'bucket-owner-full-control' will fail, as CloudTrail uses the default ACL (bucket-owner-full-control is only set for cross-account deliveries). This mismatch prevents log delivery.

Exam trap

The trap here is that candidates assume the 'bucket-owner-full-control' ACL condition is always required for CloudTrail, but it is only needed for cross-account deliveries, not same-account, causing the policy to fail silently.

How to eliminate wrong answers

Option A is wrong because the Action should be 's3:PutObject' to allow CloudTrail to write log objects; 's3:PutObjectAcl' is for modifying ACLs after upload, not the initial write. Option B is wrong because the Principal for CloudTrail delivery is the CloudTrail service principal (e.g., 'cloudtrail.amazonaws.com'), which is correct; the issue is not the principal but the ACL condition. Option D is wrong because the Resource ARN does not require an account ID in the path; the bucket policy uses the bucket ARN and a wildcard for objects (e.g., 'arn:aws:s3:::bucket-name/AWSLogs/*'), which is valid without an account ID in the path.

Full explanation →
32
MCQmedium

A security engineer is investigating a potential data exfiltration from an S3 bucket that is configured to allow public access. The engineer wants to determine who accessed the bucket and from which IP addresses. Which AWS capability should be used?

A.Amazon S3 server access logs
B.AWS IAM Access Analyzer
C.AWS CloudTrail data events for S3
D.Amazon VPC Flow Logs
AnswerC

CloudTrail data events for S3 capture object-level API calls such as GetObject, PutObject, and ListBucket, recording the IAM principal, source IP address, timestamp, and specific request parameters. Unlike management events, data events require explicit enablement on the trail or bucket, but once enabled they provide queryable, near real-time records of exactly the operations an attacker would perform to extract data. This gives investigators the necessary combination of user identity, network origin, and object-level action to confirm or refute exfiltration, making it the correct choice.

Why this answer

AWS CloudTrail data events for S3 capture detailed API activity at the object level, including GetObject, PutObject, and DeleteObject calls. This allows the security engineer to identify exactly who accessed the bucket (via the user identity) and from which IP address (via the sourceIPAddress field in the CloudTrail event). Unlike management events, data events must be explicitly enabled and provide the granularity needed for this investigation.

Exam trap

The trap here is that candidates often confuse S3 server access logs (which also log IPs and request details) with CloudTrail data events, but server access logs lack IAM user identity information and are not integrated with AWS CloudTrail's centralized audit trail, making CloudTrail the correct choice for identity-aware investigation.

How to eliminate wrong answers

Option A is wrong because Amazon S3 server access logs provide detailed records of requests made to a bucket, including IP addresses and requester information, but they are delivered as log files to a target bucket and are not real-time; they also do not capture IAM user identity details as comprehensively as CloudTrail. Option B is wrong because AWS IAM Access Analyzer is used to identify resources shared with external entities by analyzing resource-based policies, not to track who accessed a bucket or from which IP addresses. Option D is wrong because Amazon VPC Flow Logs capture IP traffic metadata at the network interface level, but they do not log S3 API operations or the identity of the requester; S3 access via the internet or AWS PrivateLink may not even traverse a VPC flow log.

Full explanation →
33
MCQmedium

Refer to the exhibit. A security engineer applies the bucket policy shown to an S3 bucket. The engineer attempts to upload a file using the AWS CLI without specifying any encryption. What is the outcome?

A.The upload fails because the policy denies all PutObject requests.
B.The upload succeeds because default encryption on the bucket will encrypt the object with SSE-S3.
C.The upload fails because the policy denies PutObject when encryption is not SSE-KMS.
D.The upload succeeds because the object is encrypted with SSE-S3 by default.
AnswerB

Default encryption is not mentioned and does not override the policy.

Why this answer

The bucket policy includes a Deny effect with a condition 'StringNotEquals': {'s3:x-amz-server-side-encryption': 'aws:kms'}. This condition denies requests only when the x-amz-server-side-encryption header is present in the request and its value is not 'aws:kms'. If the header is absent (as when the user does not specify encryption), the condition evaluates to false, meaning the Deny rule does not apply.

Therefore, the upload is not denied by this policy. Since new S3 buckets have default encryption enabled with SSE-S3, the object will be encrypted with SSE-S3, and the upload succeeds. Option A is incorrect because the policy does not deny all requests; it only denies those that include a supported but non-matching encryption header.

Option C is incorrect because it assumes the Deny applies when the header is absent, which is not the case for 'StringNotEquals' (without 'IfExists'). Option D is similar to B but B is the more precise statement.

Full explanation →
34
MCQhard

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB is configured to terminate SSL/TLS and forward traffic to the instances over HTTP. The security team wants to ensure that the instances only accept traffic from the ALB, not from any other source. How can this be achieved?

A.Configure the instance security group to allow HTTP traffic only from the VPC CIDR block.
B.Configure the instance security group to allow HTTP traffic only from the ALB's security group.
C.Configure the network ACL on the instance's subnet to allow HTTP traffic only from the ALB's private IP address.
D.Configure the instance security group to allow HTTP traffic only from the subnet CIDR block where the ALB resides.
AnswerB

Referencing the ALB's security group as the source in the instance security group rule limits inbound HTTP to traffic originating from the elastic network interfaces that actually belong to the ALB nodes. This SG-to-SG association follows the ALB as it scales or replaces its ENIs across Availability Zones, because any ENI that is a member of the ALB security group is automatically allowed. It is the recommended, least-privilege approach for placing an EC2 instance behind an Application Load Balancer.

Why this answer

Referencing the ALB's security group in the instance security group rule allows traffic only from the ALB, regardless of the ALB's IP address changes. This leverages AWS security group referencing, which is a managed and scalable way to restrict traffic to a specific source security group. The ALB's security group acts as a logical identifier, ensuring that only traffic forwarded by the ALB reaches the instances.

Exam trap

The trap here is that candidates often confuse security group referencing with IP-based rules, mistakenly thinking that using the ALB's subnet CIDR or VPC CIDR is sufficient, when in fact those approaches allow traffic from any resource in those ranges, not just the ALB.

How to eliminate wrong answers

Option A is wrong because allowing HTTP traffic from the entire VPC CIDR block would permit any resource within the VPC (including compromised instances or unauthorized services) to directly access the instances, bypassing the ALB. Option C is wrong because network ACLs are stateless and operate at the subnet level, not the instance level; they cannot restrict traffic based on the ALB's private IP address reliably since ALB IPs can change, and they would require managing both inbound and outbound rules, which is less secure and more complex than security group referencing. Option D is wrong because allowing traffic from the subnet CIDR block where the ALB resides would permit any resource in that subnet (including other instances or services) to access the instances, not just the ALB itself.

Full explanation →
35
MCQhard

A security engineer notices that an IAM user has been inactive for 90 days. What is the best way to identify and disable such users?

A.Use CloudTrail to identify users with no recent events
B.Use AWS Config rule to detect inactive users
C.Use IAM Credential Report and disable users with no activity in 90 days
D.Use AWS Organizations to disable users
AnswerC

Credential Report shows last usage.

Why this answer

The IAM Credential Report provides a comprehensive CSV export of all IAM users in the account, including the `password_last_used` and `access_key_last_used_date` columns. This allows a security engineer to directly identify users who have had no activity for 90 days and then disable them by applying an IAM policy with a `Deny` effect or removing their credentials. It is the most straightforward, native, and accurate method for this specific task.

Exam trap

The trap here is that candidates confuse CloudTrail (which logs events) with the IAM Credential Report (which directly reports user activity), or they assume AWS Config can evaluate user inactivity when it is designed for resource configuration compliance, not behavioral monitoring.

How to eliminate wrong answers

Option A is wrong because CloudTrail records API activity but does not natively aggregate or report on user inactivity over a 90-day period; you would need to write custom queries and there is no built-in 'inactive user' view. Option B is wrong because AWS Config rules evaluate resource configurations (e.g., whether an IAM user has a policy attached) but cannot directly detect user login or API activity inactivity; there is no managed Config rule for 'inactive IAM user'. Option D is wrong because AWS Organizations is a service for managing multiple AWS accounts centrally, not for disabling individual IAM users within a single account.

Full explanation →
36
Multi-Selecthard

A company has a VPC with a single public subnet and a single private subnet. The private subnet contains an RDS MySQL database that should not be accessible from the internet. The public subnet contains a bastion host that is used for SSH access to the database instance. The security team wants to ensure that the database can only be accessed from the bastion host. Which two security group rules should be configured? (Choose TWO.)

Select 2 answers
A.Database security group: Allow inbound MySQL from the public subnet CIDR.
B.Database security group: Allow inbound MySQL from the bastion security group.
C.Bastion security group: Allow inbound SSH from a limited corporate IP range.
D.Database security group: Allow inbound MySQL from 0.0.0.0/0.
E.Bastion security group: Allow inbound SSH from 0.0.0.0/0.
AnswersB, C

This restricts database access to the bastion.

Why this answer

Options B and C are correct. The database security group should allow inbound MySQL from the bastion security group (option B), ensuring only the bastion can access the database. The bastion security group should allow inbound SSH only from a limited corporate IP range (option C) to restrict administrative access.

Option A is incorrect because allowing inbound MySQL from the public subnet CIDR would permit any instance in that subnet, not just the bastion. Option D is incorrect as it allows MySQL from the entire internet. Option E is incorrect because it allows SSH from any IP, which is insecure.

Full explanation →
37
MCQhard

During an incident response, a security engineer needs to capture a memory image of a compromised Amazon EC2 instance running Linux. The instance is in a production Auto Scaling group. Which approach is BEST?

A.Use AWS CloudFormation to create a new stack with a forensic instance and copy the compromised instance's data.
B.Terminate the instance immediately to prevent further damage and launch a replacement.
C.Detach the instance from the Auto Scaling group, isolate it by changing security groups, and use AWS Systems Manager Run Command to execute a memory acquisition tool.
D.Take a snapshot of the EBS volumes and attach them to a forensic instance to analyze memory.
AnswerC

Preserves memory and allows forensic collection.

Why this answer

It preserves the volatile memory evidence by detaching the instance from the Auto Scaling group (preventing replacement) and isolating it via security group changes, then using AWS Systems Manager Run Command to execute a memory acquisition tool like LiME or AVML. This approach captures the memory image without shutting down the instance, which would destroy the evidence, and avoids the risk of the Auto Scaling group automatically terminating or replacing the instance during the investigation.

Exam trap

The trap here is that candidates confuse disk forensics (EBS snapshots) with memory forensics, assuming a snapshot captures RAM, or they prioritize immediate containment (termination) over evidence preservation, which violates the core incident response principle of 'preserve before remediate'.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation is an infrastructure-as-code service for provisioning resources, not a forensic tool; copying data from a compromised instance does not capture volatile memory, which is lost when the instance is stopped or terminated. Option B is wrong because terminating the instance immediately destroys the memory image and other volatile evidence, making forensic analysis impossible; incident response requires preserving evidence before remediation. Option D is wrong because an EBS snapshot captures only the persistent disk state (file system and storage), not the contents of RAM; memory analysis requires a dedicated memory acquisition tool executed on the running instance.

Full explanation →
38
MCQeasy

A security engineer needs to automatically detect and respond to unauthorized API calls in an AWS account. Which two services should be used together?

A.AWS CloudTrail and Amazon EventBridge
B.Amazon GuardDuty and Amazon SNS
C.AWS Config and AWS Lambda
D.Amazon Inspector and Amazon S3
AnswerA

CloudTrail logs API calls, EventBridge triggers automated responses.

Why this answer

CloudTrail logs API calls, and Amazon EventBridge can trigger automated responses based on those logs. Option A is correct. Option B (GuardDuty + SNS) provides threat detection alerts but not automated response.

Option C (Config + Lambda) is for configuration compliance, not API call detection. Option D (Inspector + S3) is for vulnerability assessment, not API monitoring.

Full explanation →
39
Multi-Selecthard

A company has a requirement to detect and alert on anomalous IAM user behavior, such as a user logging in from an unusual geographic location. The company uses AWS Organizations and has multiple accounts. Which services should the company use to meet this requirement? (Choose two.)

Select 2 answers
A.Amazon CloudWatch Logs
B.AWS Config
C.Amazon GuardDuty
D.IAM Access Analyzer
E.AWS CloudTrail
AnswersC, E

Amazon GuardDuty is a managed threat detection service that continuously analyzes CloudTrail event logs, VPC Flow Logs, and DNS query logs using machine learning models and integrated threat intelligence to identify anomalous IAM behavior. It establishes a baseline of normal user activity and generates findings when it detects deviations, such as a logon from a known malicious IP, an unusual geolocation sign-in, or API calls made from a compromised credential. GuardDuty is purpose-built to alert on these anomalies and can automatically send findings to Amazon EventBridge for response.

Why this answer

Amazon GuardDuty (C) is correct because it uses machine learning to detect anomalous IAM user behavior, such as logins from unusual geographic locations, across multiple accounts when integrated with AWS Organizations. AWS CloudTrail (E) is correct because it records all IAM user sign-in events and API calls, providing the raw data that GuardDuty analyzes. CloudTrail is essential for capturing the logs that enable GuardDuty to detect anomalies.

IAM Access Analyzer (D) is incorrect because it focuses on resource policies and unintended external access, not user behavior anomalies like unusual login locations.

Exam trap

The trap is that candidates often choose only GuardDuty or mistakenly include IAM Access Analyzer. The correct pair is GuardDuty for detection and CloudTrail for logging the events that GuardDuty analyzes. CloudTrail alone does not detect anomalies, but it is necessary for providing the data.

Full explanation →
40
Multi-Selecthard

A company wants to ensure that all API calls in their AWS account are logged and immutable. Which TWO actions should be taken? (Choose TWO.)

Select 2 answers
A.Enable MFA delete on the S3 bucket
B.Use AWS Config rules to monitor CloudTrail configuration
C.Enable S3 Object Lock on the CloudTrail S3 bucket
D.Encrypt the S3 bucket with AWS KMS
E.Enable AWS CloudTrail for all regions
AnswersC, E

Object Lock prevents log deletion or modification.

Why this answer

Enabling S3 Object Lock on the CloudTrail S3 bucket ensures that log files are immutable and cannot be overwritten or deleted by any user, including root. This is achieved through a write-once-read-many (WORM) model, which is essential for maintaining a tamper-proof audit trail of all API calls.

Exam trap

The trap here is that candidates often confuse encryption (Option D) with immutability, or they think MFA delete (Option A) provides sufficient protection, but neither prevents overwrites or ensures a WORM state, which is the core requirement for immutable logging.

Full explanation →
41
Multi-Selecteasy

Which TWO actions are best practices for securing an AWS account's root user? (Choose 2.)

Select 2 answers
A.Share the root user password with the team for emergency access
B.Use a strong password and store it securely
C.Enable multi-factor authentication (MFA) on the root user
D.Use the root user for daily administrative tasks
E.Create access keys for the root user for programmatic access
AnswersB, C

Strong password is a basic security measure.

Why this answer

The root user has unrestricted access to all AWS resources and services, so a strong, complex password (e.g., at least 14 characters with mixed case, numbers, and symbols) is essential to prevent brute-force or credential-stuffing attacks. Storing this password securely—such as in a password manager with restricted access or a physical safe—ensures it is available only to authorized personnel for emergency break-glass scenarios, aligning with the principle of least privilege and the AWS Well-Architected Framework's security pillar.

Exam trap

The trap here is that candidates often think sharing the root password with the team (Option A) is a valid emergency access strategy, but AWS explicitly recommends using IAM roles with a break-glass process (e.g., AWS Systems Manager Incident Manager) instead, as shared passwords create auditability and credential rotation issues.

Full explanation →
42
MCQeasy

A company wants to block SSH access (port 22) to all EC2 instances from the internet, but allow SSH from a specific management VPN IP range (10.0.0.0/16). Which configuration should be used?

A.Configure a security group to allow inbound SSH from 10.0.0.0/16 only.
B.Use an IAM policy to restrict SSH access to the management IP range.
C.Configure a network ACL to allow inbound SSH from 10.0.0.0/16 and deny from 0.0.0.0/0.
D.Configure a security group to allow inbound SSH from 0.0.0.0/0 and deny from 10.0.0.0/16.
AnswerA

A security group acts as a stateful instance-level firewall with an implicit deny-all for inbound traffic, so configuring a rule that allows inbound TCP port 22 from only 10.0.0.0/16 satisfies the requirement. Because security groups only contain permissive rules, any SSH connection sourced outside that CIDR is automatically blocked by the default deny, without needing an explicit deny. This approach also automatically allows return traffic for established sessions due to statefulness, so no separate outbound rule is required.

Why this answer

Security groups are stateful firewalls that control inbound and outbound traffic at the instance level. By configuring a security group to allow inbound SSH (port 22) only from the management VPN IP range (10.0.0.0/16), all other inbound traffic on port 22 is implicitly denied because security groups operate on a default-deny principle. This meets the requirement to block SSH from the internet while permitting access from the specified internal range.

Exam trap

The trap here is that candidates often confuse the stateless nature of network ACLs with the stateful behavior of security groups, leading them to choose a network ACL solution (Option C) without considering the need for explicit outbound rules, or they incorrectly think security groups can deny specific IP ranges (Option D).

How to eliminate wrong answers

Option B is wrong because IAM policies control permissions for AWS API actions (e.g., ec2:AuthorizeSecurityGroupIngress), not network traffic at the packet level; they cannot filter SSH connections to EC2 instances. Option C is wrong because network ACLs are stateless and require explicit inbound and outbound rules; allowing inbound SSH from 10.0.0.0/16 and denying from 0.0.0.0/0 would work for inbound traffic, but the outbound return traffic must also be explicitly allowed, and the question asks for a configuration that blocks SSH from the internet—security groups are the simpler, correct choice for instance-level control. Option D is wrong because security groups only support allow rules; you cannot explicitly deny traffic from a specific IP range within a security group, and allowing from 0.0.0.0/0 would permit SSH from the internet, which contradicts the requirement.

Full explanation →
43
MCQmedium

A company has an S3 bucket policy that allows cross-account access for a specific IAM role in another account. The bucket policy includes a Principal element with the ARN of the role. However, users in the other account that assume the role are unable to access the bucket. Which of the following is the MOST likely cause?

A.The IAM role does not have a permissions policy granting s3:GetObject on the bucket.
B.The bucket policy has an explicit Deny statement that overrides the Allow.
C.The role's trust policy does not allow the S3 service to assume the role.
D.The bucket policy uses the role ARN in the Principal element instead of the AWS account ID.
AnswerA

In cross-account S3 access, the requesting IAM role must have an identity-based permissions policy that explicitly allows s3:GetObject on the specific bucket. The bucket policy alone is insufficient; if the role lacks the necessary IAM permissions, the request is denied even when the bucket policy states that access is allowed. This missing permissions policy is the most common root cause when a role cannot read from a bucket it was supposedly granted access to.

Why this answer

For cross-account access using an S3 bucket policy, the IAM role in the trusted account must have a permissions policy that grants the necessary S3 actions (e.g., s3:GetObject). Without this policy, even if the bucket policy allows the role, the role itself does not have permission to perform the action. Options B, C, and D are less likely: B is possible but not the most common; C is incorrect because the trust policy allows users to assume the role, not the S3 service; D is incorrect because role ARNs are valid principals in S3 bucket policies.

Exam trap

Candidates often forget that the IAM role itself needs both a trust policy and a permissions policy. The bucket policy grants access to the role, but the role must also have the required permissions.

How to eliminate wrong answers

Option A is wrong because the question states the bucket policy allows cross-account access for a specific IAM role, and the issue is about the policy's Principal element, not the role's permissions policy; even if the role had an s3:GetObject permission, the bucket policy's Principal mismatch would still block access. Option B is wrong because there is no mention of an explicit Deny statement in the scenario; the problem is that the Allow statement itself is misconfigured due to the Principal element, not overridden by a Deny. Option C is wrong because the role's trust policy controls which entities can assume the role, not whether the S3 service can assume it; S3 does not assume roles—users or services assume roles, and the trust policy is irrelevant to S3 bucket policy evaluation.

Full explanation →
44
Drag & Dropmedium

Drag and drop the steps to implement a secure CI/CD pipeline with AWS CodePipeline and IAM in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Secure pipeline requires encrypted artifact bucket, IAM roles, source repo, build project with security scanning, and pipeline.

Full explanation →
45
MCQeasy

A security engineer discovers an Amazon GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce' for an EC2 instance. The instance is part of an Auto Scaling group and has a public IP address. What is the MOST effective immediate step to mitigate the threat?

A.Modify the network ACL to block SSH traffic from the attacker's IP.
B.Terminate the instance without detaching it from the Auto Scaling group.
C.Update the security group to restrict SSH access to known IP addresses.
D.Detach the instance from the Auto Scaling group and terminate it.
AnswerD

Detaching the instance from the Auto Scaling group before termination marks it as a manual removal from the group's lifecycle, so the scaling policy does not immediately spin up a replacement. After detaching, you can terminate it to stop the attack or preserve it for forensic analysis, while maintaining the group's desired capacity if you intentionally adjust it. This is the correct immediate response because it eliminates the compromised resource and prevents the same vulnerable workload from being automatically reintroduced.

Why this answer

The instance is compromised and part of an Auto Scaling group. Detaching it first prevents the Auto Scaling group from immediately replacing it with a new instance that might inherit the same vulnerability, allowing for forensic analysis. Terminating it after detachment stops the SSH brute force attack at its source without risking automatic re-provisioning of a similarly exposed instance.

Exam trap

The trap here is that candidates assume terminating the instance directly (Option B) is sufficient, failing to recognize that Auto Scaling groups automatically replace terminated instances, which can immediately re-expose the environment to the same threat.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and modifying them to block only the attacker's IP is ineffective against distributed brute force attacks; also, this does not address the compromised instance itself. Option B is wrong because terminating an instance that is part of an Auto Scaling group triggers the group to launch a replacement instance immediately, potentially recreating the same vulnerability if the underlying AMI or configuration is unchanged. Option C is wrong because updating the security group to restrict SSH access to known IPs is a preventive measure, not an immediate incident response step; it does not stop the ongoing attack on the already compromised instance.

Full explanation →
46
MCQmedium

A security engineer is troubleshooting why CloudTrail logs are not being delivered to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured to log management events. However, no log files appear in the bucket. What is the MOST likely cause?

A.The trail is not logging data events.
B.The S3 bucket uses SSE-KMS encryption and the trail does not have permission to use the KMS key.
C.The S3 bucket is in a different AWS account.
D.The bucket policy is missing a Deny statement.
AnswerB

When an S3 bucket uses SSE-KMS encryption, CloudTrail must have permission to call the KMS key to encrypt each delivered log file. Specifically, CloudTrail needs kms:Decrypt and kms:GenerateDataKey actions in the key policy. If those permissions are missing, CloudTrail cannot write the encrypted log objects and stops delivering logs, producing a delivery failure shown on the trail configuration page.

Why this answer

When an S3 bucket uses SSE-KMS encryption, CloudTrail requires explicit permission to use the KMS key for encrypting log files. Even if the bucket policy allows CloudTrail to write objects, the trail will fail to deliver logs if the KMS key policy does not grant the `kms:GenerateDataKey` and `kms:Decrypt` actions to the CloudTrail service principal. This is the most likely cause because the bucket policy appears correct, but the KMS key permissions are missing.

Exam trap

The trap here is that candidates assume a correct bucket policy is sufficient, overlooking that SSE-KMS encryption introduces a separate permission layer via the KMS key policy, which must explicitly authorize the CloudTrail service principal.

How to eliminate wrong answers

Option A is wrong because CloudTrail logs management events by default and does not require data events to be enabled for log delivery to an S3 bucket; data events are an additional configuration for tracking object-level operations. Option C is wrong because CloudTrail can deliver logs to an S3 bucket in a different AWS account, provided the bucket policy grants cross-account access to the CloudTrail service principal. Option D is wrong because a Deny statement is not required for CloudTrail to write logs; the bucket policy only needs an Allow statement for the CloudTrail service principal, and a missing Deny statement would not prevent delivery.

Full explanation →
47
MCQhard

A security engineer is investigating a potential breach. The engineer notices that an EC2 instance's security group allows inbound SSH (port 22) from 0.0.0.0/0. The instance is in a public subnet and has a public IP address. However, the engineer finds that SSH access is only possible from a specific IP address. What is the most likely explanation?

A.The network ACL allows inbound SSH from 0.0.0.0/0
B.The security group rule is being overridden by a more restrictive security group attached to the same instance
C.The security group rule is being evaluated but the instance's operating system firewall is blocking SSH
D.The network ACL denies inbound SSH from all IPs except the specific IP
AnswerD

Network ACLs are stateless and can explicitly deny traffic. If the NACL denies SSH from all IPs except the specific one, it would override the permissive security group rule, explaining why only that IP can connect.

Why this answer

A network ACL (NACL) can override security group rules if it denies inbound traffic. Option A is wrong because if the NACL allowed SSH from anywhere, then the restriction to a specific IP would not occur. Option B is wrong because if the NACL allowed traffic, it wouldn't explain the restriction.

Option C is wrong because security group rules are evaluated; the rule allowing all traffic would still apply.

Full explanation →
48
MCQmedium

A company uses AWS CloudTrail to log all API calls. The security team needs to be alerted when an IAM user creates a new access key. Which approach is most efficient?

A.Enable AWS Config managed rule to detect access key creation and trigger an SNS notification.
B.Create a CloudWatch Events rule that matches the CreateAccessKey event and targets an SNS topic.
C.Use CloudWatch Logs Insights to run a query every minute on CloudTrail logs and send results to SNS.
D.Configure CloudTrail to send logs to an S3 bucket and enable S3 event notifications to an SNS topic.
AnswerB

CloudWatch Events can filter specific API calls in real-time and trigger actions like SNS notifications.

Why this answer

CloudWatch Events (now part of Amazon EventBridge) can directly match the CreateAccessKey API call from AWS CloudTrail in real time and trigger an SNS notification. This approach is the most efficient as it requires no polling, no additional infrastructure, and provides immediate alerting with minimal latency.

Exam trap

The trap here is that candidates may confuse AWS Config's resource compliance monitoring with real-time event detection, or assume that S3 event notifications are suitable for low-latency security alerts, when in fact EventBridge rules are purpose-built for this use case.

How to eliminate wrong answers

Option A is wrong because AWS Config managed rules evaluate resource configurations periodically or on configuration changes, but they are not designed to detect API events like CreateAccessKey in real time; they would require a custom rule and still introduce delay. Option C is wrong because running a CloudWatch Logs Insights query every minute is inefficient, introduces up to a minute of latency, and incurs unnecessary costs for repeated scanning of log data. Option D is wrong because CloudTrail logs delivered to S3 have a delivery latency of up to 15 minutes, and S3 event notifications are not designed for real-time security alerting on API calls; this approach adds significant delay and complexity.

Full explanation →
49
MCQmedium

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. The VPC has a VPC endpoint for S3 configured. Which policy should be attached to the bucket?

A.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpce":"vpce-11111111"}}}
B.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:VpcSourceIp":"10.0.0.0/16"}}}
C.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"StringEquals":{"aws:SourceVpc":"vpc-12345678"}}}
D.{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket/*","Condition":{"IpAddress":{"aws:SourceIp":"10.0.0.0/16"}}}
AnswerA

This condition restricts access to traffic coming through the specified VPC endpoint.

Why this answer

It uses the `aws:SourceVpce` condition key to restrict access to the S3 bucket exclusively to requests originating from the specified VPC endpoint (vpce-11111111). This ensures that only traffic routed through that VPC endpoint, which is attached to the specific VPC, can perform `s3:GetObject` actions, effectively limiting access to the VPC's private network.

Exam trap

The trap here is that candidates often confuse `aws:SourceVpc` with `aws:SourceVpce` or mistakenly use IP-based conditions like `aws:SourceIp` or `aws:VpcSourceIp`, not realizing that for S3 bucket policies, the correct condition key to restrict to a specific VPC endpoint is `aws:SourceVpce`, and that `aws:SourceVpc` is not supported for S3 gateway endpoints.

How to eliminate wrong answers

Option B is wrong because `aws:VpcSourceIp` is not a valid condition key; the correct key for VPC endpoint traffic is `aws:SourceVpce` or `aws:SourceVpc`, not an IP-based condition. Option C is wrong because `aws:SourceVpc` condition key checks the VPC ID of the requester, but this only works for VPC endpoints that support the `aws:SourceVpc` key (e.g., some AWS services), and for S3 gateway endpoints, the `aws:SourceVpc` key is not available; instead, `aws:SourceVpce` must be used to restrict to a specific endpoint. Option D is wrong because `aws:SourceIp` condition key cannot be used to restrict traffic from a VPC endpoint, as the source IP of requests through a VPC endpoint is the private IP of the endpoint's network interface, which is not reliably the same as the VPC's CIDR range, and the condition key `aws:SourceIp` is intended for public IP addresses, not private IPs from VPC endpoints.

Full explanation →
50
MCQeasy

An IAM user receives an 'AccessDenied' error when trying to list objects in an S3 bucket. The user has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}]}. What is the most likely reason?

A.The policy is missing a condition
B.The bucket policy explicitly denies the action
C.The policy does not include s3:GetObject
D.The policy has a syntax error
AnswerB

An explicit deny in the bucket policy overrides the user policy allow.

Why this answer

The IAM policy grants the s3:ListBucket action on the bucket, which should allow listing objects. However, an explicit deny in a bucket policy overrides any allow, including those from IAM policies. Since the user receives an 'AccessDenied' error, the most likely cause is that the bucket policy explicitly denies the s3:ListBucket action for this user, as explicit denies take precedence over all allows.

Exam trap

The trap here is that candidates often assume an IAM policy alone is sufficient and forget that bucket policies can explicitly deny actions, overriding IAM allows, leading them to incorrectly choose options like missing permissions or syntax errors.

How to eliminate wrong answers

Option A is wrong because a missing condition would not cause an 'AccessDenied' error if the action and resource are correctly allowed; conditions only further restrict access, and their absence typically broadens access. Option C is wrong because s3:GetObject is not required for listing objects; s3:ListBucket alone is sufficient for the ListObjects operation. Option D is wrong because a syntax error would result in a different error (e.g., 'MalformedPolicy') or the policy would be invalid, not an 'AccessDenied' error during the API call.

Full explanation →
51
MCQmedium

Refer to the exhibit. A security engineer runs the CLI command and receives the output shown. The engineer expects to see flow logs for a specific subnet, but the output shows the resource ID as a VPC. What is the most likely reason?

A.The flow log is not active; it shows ACTIVE, so that's not the issue.
B.The flow log is configured to deliver to CloudWatch, but the log group name is incorrect.
C.The IAM role does not have permissions to deliver logs for subnets.
D.The flow log was created at the VPC level, not at the subnet level.
AnswerD

The resource ID in the flow log output is prefixed with "vpc-", which indicates the flow log was created at the VPC level rather than at the subnet level. As a result, the flow log captures all traffic in the VPC, and the query is not filtering for the specific subnet due to the resource scope. To see subnet-specific flow logs, you must create a separate flow log with the subnet ID as the resource ID.

Why this answer

The output shows the resource ID as a VPC (vpc-xxxx), but the security engineer expected to see flow logs for a specific subnet. This indicates that the flow log was created at the VPC level, not at the subnet level. In AWS, VPC Flow Logs can be created at the VPC, subnet, or network interface level, and the resource ID in the flow log output reflects the level at which the log was configured.

Since the engineer expected subnet-level logs, the most likely reason is that the flow log was created for the entire VPC instead of the specific subnet.

Exam trap

The trap here is that candidates may assume the flow log is misconfigured due to permissions or delivery settings, when the real issue is the scope at which the flow log was created—a common confusion between VPC-level and subnet-level flow logs.

How to eliminate wrong answers

Option A is wrong because the flow log is indeed active (ACTIVE status), so inactivity is not the issue. Option B is wrong because the log group name being incorrect would not cause the resource ID to show a VPC instead of a subnet; it would affect log delivery but not the resource identifier in the output. Option C is wrong because IAM role permissions for delivering logs to CloudWatch are not related to the level (VPC vs. subnet) at which the flow log is created; permissions issues would prevent log delivery entirely, not change the resource ID shown.

Full explanation →
52
MCQhard

A security engineer notices that an Amazon EC2 instance has a security group that allows inbound SSH (port 22) from 0.0.0.0/0. The instance is a bastion host. What is a more secure alternative to this configuration?

A.Change the SSH port to a non-standard port to avoid automated attacks.
B.Restrict the inbound SSH rule to a single IP address from the corporate network.
C.Replace the security group rule with a network ACL that allows SSH from 0.0.0.0/0.
D.Remove the inbound SSH rule and use AWS Systems Manager Session Manager to access the instance.
AnswerD

Removing the inbound SSH rule and using AWS Systems Manager Session Manager closes the port 22 listener entirely, so the instance is not reachable over SSH from the network. Session Manager authenticates the user through IAM, authorizes actions with IAM policies, and sends the interactive shell session over an encrypted channel initiated by the SSM Agent. Sessions can be audited and recorded via S3 or CloudWatch Logs, and you can use a VPC endpoint so traffic never traverses an open internet-facing port. This avoids the need for SSH key management and eliminates brute-force exposure.

Why this answer

AWS Systems Manager Session Manager provides secure, auditable, and keyless shell access to EC2 instances without opening any inbound ports. It uses the AWS Systems Manager agent to initiate an outbound connection to the AWS SSM endpoint over HTTPS (port 443), eliminating the need for a bastion host or any inbound SSH rule. This approach also integrates with AWS Identity and Access Management (IAM) for fine-grained access control and AWS CloudTrail for full session logging.

Exam trap

The trap here is that candidates often think restricting SSH to a single IP (Option B) is the most secure approach, but the exam tests the concept of eliminating inbound access entirely through agent-based outbound-only solutions like Session Manager, which is a key principle of the AWS Well-Architected Framework's security pillar.

How to eliminate wrong answers

Option A is wrong because changing the SSH port to a non-standard port only obscures the service from automated scans but does not prevent targeted attacks or port scanning; it violates security by obscurity principles and is not a secure alternative. Option B is wrong because restricting the inbound SSH rule to a single corporate IP address still leaves the bastion host exposed to SSH vulnerabilities, requires maintaining a bastion host, and does not eliminate the attack surface of an open SSH port. Option C is wrong because replacing the security group rule with a network ACL that allows SSH from 0.0.0.0/0 is actually less secure—network ACLs are stateless and do not provide the same stateful filtering as security groups, and they still expose the instance to inbound SSH traffic from the entire internet.

Full explanation →
53
Multi-Selecteasy

Which TWO AWS services provide native integration with Amazon CloudWatch Logs for real-time monitoring of application logs? (Choose TWO.)

Select 2 answers
A.Amazon S3
B.Amazon Route 53
C.Amazon EC2
D.AWS Lambda
E.AWS CloudTrail
AnswersC, D

EC2 can use the CloudWatch agent to send logs.

Why this answer

Amazon EC2 is correct because it can be configured to send application logs to CloudWatch Logs via the CloudWatch Logs agent or unified CloudWatch agent, enabling real-time monitoring, search, and alerting on log data. AWS Lambda is correct because it natively integrates with CloudWatch Logs: every Lambda function execution automatically streams its logs to a CloudWatch Logs group, providing real-time visibility into function output and errors.

Exam trap

The SCS-C02 exam often tests the distinction between services that natively produce or stream application logs to CloudWatch Logs versus services that can only send logs via additional configuration or are limited to audit/API logs, leading candidates to mistakenly select CloudTrail or S3 as native integrations.

Full explanation →
54
MCQeasy

The exhibit shows an S3 bucket policy. The security team wants to ensure that only users from account 123456789012 can access objects in the bucket. What is a potential security issue with this policy?

A.The policy grants access to all IAM users in the account, not just specific ones.
B.The policy does not restrict access to a specific VPC.
C.The policy uses a wildcard in the resource ARN.
D.The policy does not require MFA.
AnswerA

Using the root ARN grants access to the entire account, not a specific principal.

Why this answer

The policy uses a Principal of "123456789012" which effectively grants access to all IAM users and roles within that AWS account. This means any user in the account who has permission to call s3:GetObject can access the bucket objects, making it overly permissive. The correct answer is A because this is the security issue—no restriction to specific users or roles.

Full explanation →
55
MCQhard

A security engineer needs to ensure that an IAM role can be assumed only from a specific VPC. Which IAM policy condition key should be used?

A.aws:RequestedRegion
B.aws:VpcSourceIp
C.aws:SourceVpc
D.aws:SourceIp
AnswerC

This is the correct condition key. It restricts requests to originate from a specified VPC.

Why this answer

Aws:SourceVpc. This condition key allows you to restrict requests to originate from a specific VPC ID. Option A, aws:RequestedRegion, restricts region, not VPC.

Option B, aws:VpcSourceIp, is not a valid condition key. Option D, aws:SourceIp, restricts source IP address, not VPC.

Full explanation →
56
Multi-Selecthard

A security team wants to implement a centralized logging solution for multiple AWS accounts. The team needs to collect VPC Flow Logs, CloudTrail logs, and DNS query logs from all accounts. Which THREE services should the team use to aggregate these logs? (Choose THREE.)

Select 3 answers
A.AWS CloudHSM
B.AWS Config
C.Amazon Route 53 Resolver query logging
D.AWS CloudTrail
E.VPC Flow Logs
AnswersC, D, E

Resolver query logs can be published to a central S3 bucket for DNS query logs.

Why this answer

Amazon Route 53 Resolver query logging (Option C) is correct because it enables centralized collection of DNS query logs from VPCs across multiple AWS accounts. By configuring Route 53 Resolver query logging to send logs to a central Amazon S3 bucket or CloudWatch Logs group, the security team can aggregate DNS query logs from all accounts, meeting the requirement for centralized DNS logging.

Exam trap

The trap here is that candidates may confuse AWS CloudHSM or AWS Config as logging services, but neither is designed for log collection or aggregation; CloudHSM is for key management and Config is for configuration auditing, not for aggregating VPC Flow Logs, CloudTrail logs, or DNS query logs.

Full explanation →
57
MCQhard

A security team uses Amazon Macie to discover sensitive data in S3. They have configured Macie to run automated sensitive data discovery jobs. After reviewing the findings, they notice that some S3 objects containing personally identifiable information (PII) are not being flagged. What is the most likely cause?

A.The Macie service-linked role does not have permissions to read the objects.
B.The S3 bucket is in a different AWS Region than the Macie job.
C.The S3 objects are encrypted with SSE-S3.
D.The PII is in a format that Macie's managed data identifiers do not recognize, and no custom data identifier is configured.
AnswerD

This is correct because Macie relies on managed data identifiers that recognize common PII patterns, such as US Social Security numbers and credit card numbers. If the PII is in a proprietary or less common format that these built-in identifiers do not match, Macie will not flag it. Since no custom data identifier was created to define that specific format, Macie has no way to detect the sensitive data, so the data goes undiscovered.

Why this answer

Macie uses managed data identifiers to detect PII based on predefined patterns. If the PII in the S3 objects is in a format that does not match any of these managed identifiers (e.g., a non-standard date format or a custom ID number), and no custom data identifier has been configured to recognize that specific pattern, Macie will not flag the objects. This is the most likely cause given that the security team has already configured automated discovery jobs and other common issues like permissions or encryption are not preventing scanning.

Exam trap

The trap here is that candidates often assume encryption (SSE-S3) or cross-region issues block Macie, but Macie is designed to handle both seamlessly, and the real limitation is the scope of its pattern-matching identifiers.

How to eliminate wrong answers

Option A is wrong because the Macie service-linked role (AWSServiceRoleForAmazonMacie) is automatically created and granted the necessary permissions (e.g., s3:GetObject, s3:ListBucket) to read objects in S3 buckets that are in scope for the discovery job; if the role lacked permissions, Macie would report an access error, not silently skip objects. Option B is wrong because Macie supports cross-region analysis: a single Macie job can analyze S3 buckets in any AWS Region, as long as the bucket is in the same AWS partition and the Macie service is enabled in the job's home Region. Option C is wrong because Macie can scan objects encrypted with SSE-S3 (Amazon S3-managed keys) without any additional configuration; SSE-S3 encryption does not block Macie's read access because Macie uses the service-linked role to decrypt the objects via S3's server-side decryption.

Full explanation →
58
MCQhard

A company has a security requirement to automatically isolate an Amazon EC2 instance that is generating high network traffic to a known malicious IP address. The company uses Amazon GuardDuty and AWS Lambda. Which combination of services and configurations should be used to achieve the isolation?

A.Use VPC Flow Logs to send logs to CloudWatch Logs, then create a metric filter that triggers a Lambda function.
B.Use Amazon GuardDuty to send findings to AWS Systems Manager Automation to run a document that isolates the instance.
C.Use Amazon GuardDuty to send findings to Amazon CloudWatch Events, which triggers an AWS Lambda function that modifies the security group to remove the instance.
D.Use AWS Config rules to detect the traffic and invoke a Lambda function to change the security group.
AnswerC

Amazon GuardDuty is purpose-built to generate security findings based on threat intelligence and anomaly detection, including malicious IP addresses attempting to communicate with EC2 instances. These findings can be delivered as events to Amazon CloudWatch Events (or Amazon EventBridge) using a rule that matches specific finding types, and that rule triggers an AWS Lambda function. The Lambda function can then programmatically modify the instance's security group—removing its association or revoking ingress/egress rules—to automatically isolate the compromised resource. This is a well-established, near-real-time automated response pattern that requires no manual intervention and directly ties a confirmed threat to an infrastructure-level containment action.

Why this answer

Amazon GuardDuty generates findings for threats like communication with known malicious IPs, and these findings can be sent to Amazon CloudWatch Events (now Amazon EventBridge). CloudWatch Events can then trigger an AWS Lambda function that modifies the security group associated with the EC2 instance to remove its inbound/outbound rules, effectively isolating the instance. This automated workflow meets the security requirement without manual intervention.

Exam trap

The trap here is that candidates may think GuardDuty can directly trigger Systems Manager Automation (Option B) without the intermediate CloudWatch Events step, or they may confuse AWS Config's compliance evaluation with real-time network threat detection (Option D).

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs are used for network traffic analysis and logging, not for real-time threat detection; creating a metric filter to trigger a Lambda function would require custom logic to identify malicious IPs and would not leverage GuardDuty's built-in threat intelligence. Option B is wrong because while AWS Systems Manager Automation can run documents to isolate instances, GuardDuty does not natively send findings directly to Systems Manager Automation; it sends findings to CloudWatch Events, which can then trigger Systems Manager Automation, but the option omits the necessary CloudWatch Events integration. Option D is wrong because AWS Config rules are designed for compliance and resource configuration changes, not for detecting network traffic patterns or malicious IP communication; they cannot evaluate VPC Flow Logs or network traffic in real time.

Full explanation →
59
MCQmedium

A security engineer runs the above AWS CLI command. The engineer notices that the security group has no outbound rules. What is the implication of this configuration?

A.The EC2 instances in this security group cannot initiate outbound connections
B.The EC2 instances cannot receive inbound HTTP traffic
C.The security group allows all outbound traffic by default
D.Outbound traffic is allowed because security groups are stateful
AnswerA

Without outbound rules, all outbound traffic is denied.

Why this answer

A security group without outbound rules will block all outbound traffic by default (since security groups are stateful and default deny egress). Option B is wrong because security groups are stateful; the inbound rule allows return traffic. Option C is wrong because the inbound rule allows HTTP from anywhere, but outbound is missing.

Option D is wrong because the security group does allow inbound HTTP.

Full explanation →
60
Multi-Selectmedium

A company is using Amazon GuardDuty to detect threats. The security team wants to receive alerts for specific findings. Which TWO AWS services can be used to forward GuardDuty findings to a custom application for analysis? (Choose two.)

Select 2 answers
A.Amazon CloudWatch Events (Amazon EventBridge)
B.Amazon Kinesis Data Streams
C.Amazon Simple Queue Service (SQS)
D.AWS Lambda
E.Amazon S3
AnswersA, E

GuardDuty publishes findings to EventBridge, which can then route to various targets.

Why this answer

Amazon GuardDuty can publish findings to Amazon CloudWatch Events (now part of Amazon EventBridge) as events. These events can then be routed to a custom application via targets like AWS Lambda, SQS, or Kinesis, enabling real-time analysis and alerting. This is the primary, native integration for forwarding GuardDuty findings to downstream systems.

Exam trap

The trap here is that candidates confuse the service that receives the finding (EventBridge) with the service that processes or stores it (Lambda, SQS, Kinesis), forgetting that EventBridge is the required intermediary for forwarding GuardDuty findings to any custom application.

Full explanation →
61
Multi-Selectmedium

Which TWO actions can help protect data at rest in Amazon EBS volumes? (Choose 2.)

Select 2 answers
A.Enable automatic encryption of EBS snapshots by default.
B.Use an instance type that supports encryption at rest.
C.Configure the operating system to use encrypted file systems.
D.Enable EBS encryption by default in the AWS Account settings.
E.Use encrypted EBS volumes with AWS KMS customer-managed keys.
AnswersD, E

This encrypts all new EBS volumes.

Why this answer

Options D and E are correct. D: Enabling EBS encryption by default in AWS Account settings ensures that all new EBS volumes are encrypted at rest. E: Using encrypted EBS volumes with AWS KMS customer-managed keys provides granular control over encryption keys.

Option A is incorrect because EBS snapshots are not automatically encrypted by default; they can be encrypted during copy or by enabling encryption by default for volumes. Option B is incorrect because encryption at rest is independent of instance type; any instance type can use encrypted EBS volumes. Option C is incorrect because configuring the OS to use encrypted file systems is not the primary method for protecting data at rest on EBS; EBS encryption at the volume level is more appropriate.

Full explanation →
62
Multi-Selectmedium

Which TWO actions can be taken to improve the security of an Amazon RDS for MySQL database instance? (Choose TWO.)

Select 2 answers
A.Place the RDS instance in a private subnet and restrict inbound traffic to the application security group.
B.Disable automated backups to reduce storage costs.
C.Enable Multi-AZ deployment for fault tolerance.
D.Assign a public IP address to the RDS instance for easier access from the internet.
E.Enable encryption at rest using AWS KMS.
AnswersA, E

Network isolation improves security.

Why this answer

Placing the RDS instance in a private subnet ensures it is not directly accessible from the internet, which reduces the attack surface. Restricting inbound traffic to only the application security group (using security group rules) ensures that only the specific application servers can connect to the database, following the principle of least privilege. This is a fundamental network security best practice for database instances.

Exam trap

The trap here is that candidates often confuse high availability (Multi-AZ) or cost-saving measures (disabling backups) with security controls, when in fact they do not address confidentiality, integrity, or access control.

Full explanation →
63
MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?

A.Use an HTTPS listener on the ALB and configure the target group with HTTPS.
B.Use a TCP listener on the ALB and a TCP target group.
C.Configure security group inbound rules to allow only HTTPS traffic.
D.Use an HTTP listener on the ALB and HTTP on the target group.
AnswerA

HTTPS ensures encryption from ALB to instances.

Why this answer

It ensures end-to-end encryption between the ALB and EC2 instances. By configuring an HTTPS listener on the ALB, traffic from clients to the ALB is encrypted. Then, by setting the target group protocol to HTTPS, the ALB re-encrypts the traffic before forwarding it to the EC2 instances, fulfilling the security team's requirement that all traffic between the ALB and EC2 instances be encrypted.

Exam trap

The trap here is that candidates assume an HTTPS listener alone encrypts all traffic end-to-end, forgetting that the ALB-to-instance leg must also use HTTPS; otherwise, traffic between the ALB and EC2 instances is in plaintext.

How to eliminate wrong answers

Option B is wrong because a TCP listener and TCP target group operate at Layer 4 and do not provide encryption; they forward raw TCP traffic without TLS/SSL termination or re-encryption. Option C is wrong because security group inbound rules only control access at the network level (allowing or denying traffic based on port/protocol) and do not encrypt traffic; encryption is a function of the protocol (HTTPS/TLS), not security group rules. Option D is wrong because using HTTP on both the listener and target group means traffic is transmitted in plaintext at every hop, with no encryption between the ALB and EC2 instances.

Full explanation →
64
MCQmedium

During a security review, a security engineer notices that an S3 bucket contains sensitive data but has a bucket policy that allows access from any principal in the account. The engineer needs to identify any unintended cross-account access to this bucket. Which AWS service should be used?

A.AWS Config
B.AWS IAM Access Analyzer
C.AWS Trusted Advisor
D.Amazon Macie
AnswerB

AWS IAM Access Analyzer is specifically designed to identify unintended access to your resources from external entities. It applies automated reasoning to resource-based policies and generates findings that list the external principal, the resource, and the specific action granted, helping security engineers quickly identify and remediate cross-account access. This makes it the correct service for a security review focused on discovering whether any external accounts have been granted access to your resources.

Why this answer

AWS IAM Access Analyzer helps identify resources that are shared with external principals by analyzing resource-based policies (like S3 bucket policies). In this scenario, the bucket policy allows access from any principal in the account, but IAM Access Analyzer can detect if the policy also grants access to principals outside the AWS account (cross-account access). It generates findings for any policy that allows access from an external entity, making it the correct service to identify unintended cross-account access.

Exam trap

The trap here is that candidates often confuse AWS Config (which can detect public S3 buckets) with IAM Access Analyzer (which specifically detects cross-account access), leading them to choose Config when the question explicitly asks for unintended cross-account access, not just public access.

How to eliminate wrong answers

Option A is wrong because AWS Config evaluates resource compliance against rules but does not specifically analyze bucket policies for cross-account access; it can detect public access but not granular cross-account sharing. Option C is wrong because AWS Trusted Advisor provides best-practice checks (including S3 bucket permissions) but only flags buckets that are publicly accessible or open to all authenticated AWS users, not specifically cross-account access from a specific external account. Option D is wrong because Amazon Macie discovers and classifies sensitive data using machine learning, but it does not analyze bucket policies for cross-account permissions; it focuses on data content, not access controls.

Full explanation →
65
MCQhard

Refer to the exhibit. A security engineer is reviewing the bucket encryption configuration. The bucket is used to store sensitive data. The company policy requires that all objects be encrypted using AWS KMS with a customer managed key. What should the engineer do to meet the policy?

A.Enable the bucket key and set SSEAlgorithm to AES256
B.Use client-side encryption with a KMS key
C.Update the bucket encryption configuration to use SSEAlgorithm: aws:kms and specify a KMS key ID
D.Add a bucket policy that requires kms:Encrypt permission for all PutObject requests
AnswerC

Changes default encryption to SSE-KMS.

Why this answer

The current bucket encryption configuration uses SSE-S3 (AES256). To meet the policy requiring KMS with a customer managed key, the engineer must update the bucket's default encryption settings to use SSE-KMS (aws:kms) and specify the KMS key ID. Option C correctly describes this.

Option A is incorrect because enabling the bucket key with SSE-S3 does not change the encryption algorithm to KMS. Option B is incorrect because client-side encryption with a KMS key is not a bucket-level configuration; it is applied by the client before upload and does not modify the default server-side encryption setting. Option D is incorrect because adding a bucket policy that requires kms:Encrypt permission for PutObject requests does not enforce server-side encryption with KMS; it only authorizes KMS encryption if used, but objects could still be uploaded without specifying KMS encryption.

Full explanation →
66
MCQhard

A global e-commerce company operates in three AWS Regions: us-east-1, eu-west-1, and ap-southeast-1. The company uses AWS Organizations with 50 member accounts grouped by business unit. The security team recently discovered that several S3 buckets containing customer data were accidentally made public due to misconfigured bucket policies. The team wants to implement a preventive control that blocks any S3 bucket from becoming public across all accounts, while still allowing authorized cross-account access. The solution must be centrally managed and not require changes to existing IAM policies. Additionally, the team needs to be notified immediately when a public bucket is attempted. Which solution meets all requirements?

A.Use Amazon Macie to discover public buckets and alert the security team.
B.Create an SCP that denies s3:PutBucketPolicy only for policies that specify 'Principal': '*' or 'Principal': {'AWS': '*'}
C.Create an SCP that denies s3:PutBucketPolicy and s3:PutBucketAcl when the condition includes making the bucket public, and use CloudTrail and CloudWatch Events to send notifications on denied API calls.
D.Deploy an AWS Config rule in each account that triggers a Lambda function to make non-compliant buckets private.
AnswerC

SCPs are preventive and centrally managed; CloudTrail logs denied events, and CloudWatch Events can trigger SNS for notifications.

Why this answer

It uses an SCP to centrally deny the s3:PutBucketPolicy and s3:PutBucketAcl actions when the request would make a bucket public, which is a preventive control that blocks the operation before it happens. The requirement for immediate notification is met by using CloudTrail to log the denied API calls and CloudWatch Events to trigger alerts, all without modifying existing IAM policies or requiring per-account changes.

Exam trap

The trap here is that candidates often confuse detective controls (like Macie or Config rules that remediate) with preventive controls (like SCPs that block the action), and they may overlook that SCPs can deny specific API actions with conditions to precisely target public bucket creation without affecting authorized cross-account access.

How to eliminate wrong answers

Option A is wrong because Amazon Macie is a data discovery and classification service that can detect public buckets after they exist, but it is a detective control, not a preventive control that blocks the action. Option B is wrong because an SCP that denies s3:PutBucketPolicy only when 'Principal': '*' or 'Principal': {'AWS': '*'} is specified does not cover all ways a bucket can become public, such as through bucket ACLs (s3:PutBucketAcl) or policies that grant public access via other principal patterns (e.g., 'Principal': {'AWS': 'arn:aws:iam::123456789012:root'} with a condition that allows anonymous access). Option D is wrong because an AWS Config rule that triggers a Lambda function to make non-compliant buckets private is a reactive (corrective) control, not a preventive control that blocks the bucket from becoming public in the first place, and it requires per-account deployment rather than being centrally managed.

Full explanation →
67
Multi-Selecthard

A company is migrating on-premises file servers to Amazon EFS. The data must be encrypted at rest and in transit. Which THREE steps should the company take to meet these requirements?

Select 3 answers
A.Use a KMS customer managed key for encryption at rest
B.Use AWS Certificate Manager to issue a certificate
C.Install an SSL certificate on the EFS file system
D.Mount the EFS file system using TLS
E.Enable encryption at rest on the EFS file system
AnswersA, D, E

Using a KMS customer managed key is a way to control the encryption key for at-rest encryption, but it requires that encryption at rest is enabled first. This is a necessary step.

Why this answer

To meet the requirements for encryption at rest and in transit on Amazon EFS, you need three steps: (1) Use a KMS customer managed key for encryption at rest (option A). (2) Enable encryption at rest on the EFS file system (option E). (3) Mount the EFS file system using TLS to ensure encryption in transit (option D). Option B (using AWS Certificate Manager) is not needed because EFS does not require certificates for its TLS implementation. Option C (installing an SSL certificate on the EFS file system) is incorrect because EFS does not support installing certificates directly; TLS is handled at the client side during mounting.

Full explanation →
68
Multi-Selecthard

A security engineer is designing a permissions boundary for an IAM user. Which TWO statements about permissions boundaries are correct?

Select 2 answers
A.Permissions boundaries can be applied to service-linked roles.
B.Permissions boundaries can only be applied to IAM users, not roles.
C.The effective permissions are the intersection of the identity-based policy and the permissions boundary.
D.Permissions boundaries can override resource-based policies.
E.A permissions boundary alone does not grant permissions; an identity-based policy is also required.
AnswersC, E

Intersection of both policies.

Why this answer

The correct answers are C and E. Permissions boundaries set the maximum permissions that an identity-based policy can grant. The effective permissions are the intersection of the identity-based policy and the permissions boundary (C).

A permissions boundary alone does not grant permissions; you must also attach an identity-based policy (E). Option A is incorrect because permissions boundaries cannot be applied to service-linked roles. Option B is incorrect because permissions boundaries can be applied to both IAM users and roles.

Option D is incorrect because permissions boundaries do not affect resource-based policies; they only limit identity-based policies.

Full explanation →
69
MCQmedium

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The engineer needs to immediately block the traffic and capture a packet capture for forensic analysis. Which combination of actions should the engineer take?

A.Use Amazon GuardDuty to block the IP and enable VPC Traffic Mirroring.
B.Add a network ACL deny rule for the malicious IP, and enable VPC Traffic Mirroring.
C.Stop the EC2 instance and enable VPC Flow Logs.
D.Modify the security group to deny outbound traffic to the IP, and enable VPC Flow Logs.
AnswerB

Network ACLs act as a stateless firewall at the subnet level, and they explicitly support deny rules that are evaluated in numeric order before traffic reaches the EC2 instance. Adding a deny rule for the malicious IP immediately blocks both inbound and outbound traffic from that source at the subnet boundary. VPC Traffic Mirroring complements this by capturing full packet payloads, giving the security engineer the packet-level forensic data needed to investigate the incident without disrupting the traffic flow.

Why this answer

A network ACL (NACL) is a stateless firewall that operates at the subnet level, allowing immediate blocking of traffic to/from a specific IP address without affecting the instance's security group rules. Enabling VPC Traffic Mirroring captures a full packet-level copy of the traffic for forensic analysis, which is superior to VPC Flow Logs (which only capture metadata). This combination provides both rapid containment and deep forensic data.

Exam trap

The trap here is that candidates confuse security groups (stateful, allow-only) with network ACLs (stateless, allow/deny) and mistakenly think a security group can block a specific IP, or they assume VPC Flow Logs provide packet-level capture when they only provide metadata.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service, not a blocking mechanism; it cannot directly block traffic, and VPC Traffic Mirroring is not enabled via GuardDuty. Option C is wrong because stopping the EC2 instance halts all traffic but prevents capturing live malicious traffic for analysis, and VPC Flow Logs only provide metadata (source/destination IP, ports, protocol) not full packet payloads. Option D is wrong because security groups are stateful and cannot deny outbound traffic to a specific IP address; they only support allow rules, and VPC Flow Logs do not capture packet contents.

Full explanation →
70
MCQmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to enable CloudTrail for all accounts and centrally store logs. What is the most efficient way to achieve this?

A.Use an S3 bucket policy to allow cross-account log delivery
B.Create a CloudTrail trail in the management account and apply it to all accounts in the organization
C.Use AWS Lambda to create trails in each account
D.Ask each account admin to create their own CloudTrail trail and deliver to a central S3 bucket
AnswerB

Organization trails log all accounts centrally.

Why this answer

AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts within the organization. This is the most efficient method as it eliminates the need for manual per-account configuration or custom automation, and it ensures consistent logging across the entire organization with centralized log delivery to a single S3 bucket.

Exam trap

The trap here is that candidates often assume cross-account S3 bucket policies (Option A) are sufficient, overlooking the native organization-wide trail capability that automates trail creation and management across all accounts.

How to eliminate wrong answers

Option A is wrong because while an S3 bucket policy can allow cross-account log delivery, it does not automate the creation of CloudTrail trails in each account; each account would still need to manually create its own trail, which is inefficient and error-prone. Option C is wrong because using AWS Lambda to create trails in each account introduces unnecessary complexity, potential latency, and maintenance overhead compared to the native organization-wide trail feature. Option D is wrong because asking each account admin to create their own trail is not only inefficient but also risks inconsistent configurations, missing logs, and increased administrative burden.

Full explanation →
71
MCQhard

A company uses Amazon RDS for MySQL and needs to monitor database activity for suspicious queries, such as unauthorized access attempts or SQL injection. The security team wants to centralize the logs from multiple RDS instances and analyze them in near real-time. Which solution should be implemented?

A.Enable RDS Enhanced Monitoring and stream the metrics to Amazon CloudWatch.
B.Enable VPC Flow Logs for the RDS instances and analyze the logs using Amazon Athena.
C.Enable AWS CloudTrail for RDS API calls and use Amazon GuardDuty to analyze the logs.
D.Enable database audit logs on each RDS instance, stream them to Amazon CloudWatch Logs, and use CloudWatch Logs Insights to query the logs.
AnswerD

Audit logs capture SQL queries; CloudWatch Logs provides centralized storage and analysis.

Why this answer

RDS for MySQL audit logs capture detailed database-level activity, including login attempts, query execution, and SQL injection patterns. Streaming these logs to CloudWatch Logs enables near real-time analysis using CloudWatch Logs Insights, which supports querying and alerting on suspicious queries across multiple RDS instances from a centralized location.

Exam trap

The trap here is confusing database-level audit logs (which capture SQL queries and authentication events) with infrastructure-level logs like Enhanced Monitoring or VPC Flow Logs, leading candidates to choose options that monitor performance or network traffic instead of actual database activity.

How to eliminate wrong answers

Option A is wrong because RDS Enhanced Monitoring provides OS-level metrics (CPU, memory, disk I/O) but does not capture database query content or authentication events needed to detect suspicious queries or SQL injection. Option B is wrong because VPC Flow Logs record network traffic metadata (IP addresses, ports, protocols) but do not include database query text or user authentication details; they cannot identify SQL injection or unauthorized access attempts at the database level. Option C is wrong because AWS CloudTrail logs RDS API calls (e.g., CreateDBInstance, ModifyDBInstance) but does not capture database engine-level activity such as SQL queries or login attempts; GuardDuty analyzes CloudTrail, VPC Flow Logs, and DNS logs for threats but cannot inspect database query content.

Full explanation →
72
MCQmedium

A company uses AWS CloudTrail to log API activity across multiple accounts. The security team wants to ensure that any S3 bucket created with public read access is detected within minutes. Which solution is MOST efficient?

A.Create an Amazon EventBridge rule that matches CloudTrail CreateBucket API calls and triggers a Lambda function that inspects the bucket's public access settings and alerts if public.
B.Use AWS Config rules to check S3 bucket public access settings and trigger an AWS Lambda function to send alerts.
C.Use S3 server access logs and run a daily script to parse the logs for PutBucketAcl actions.
D.Enable CloudTrail log file validation and use Athena to query logs hourly for CreateBucket events with public ACLs.
AnswerA

An EventBridge rule can pattern-match CloudTrail API events as they are emitted, meaning a CreateBucket call with a public access configuration triggers the Lambda function within seconds of the API completing. The Lambda can then use GetPublicAccessBlock, GetBucketPolicyStatus, or GetBucketAcl to determine whether the bucket is actually public and immediately alert a security team, making this the only option that combines near-real-time detection with direct inspection of the resulting bucket configuration.

Why this answer

It uses an Amazon EventBridge rule to capture the CloudTrail `CreateBucket` API call in near real-time, then triggers a Lambda function to immediately inspect the bucket's public access settings. This approach detects public buckets within minutes without polling or batch processing, making it the most efficient solution for the stated requirement.

Exam trap

The trap here is that candidates often choose AWS Config rules (Option B) because they associate Config with compliance checks, but they overlook the latency of Config evaluations versus the near-real-time capability of EventBridge for API-driven detection.

How to eliminate wrong answers

Option B is wrong because AWS Config rules evaluate resource configurations on a periodic basis (e.g., every 10 minutes or hourly) or on configuration changes, but they do not guarantee detection within minutes of the bucket creation; the evaluation delay can exceed the required time window. Option C is wrong because S3 server access logs are delivered on a best-effort basis, often with delays of several hours, and a daily script would not meet the 'within minutes' requirement. Option D is wrong because CloudTrail log file validation only ensures integrity, not real-time detection, and using Athena to query logs hourly introduces at least a one-hour delay, failing the 'within minutes' requirement.

Full explanation →
73
Multi-Selecteasy

A security engineer is configuring automated response to a specific GuardDuty finding type. The engineer wants to automatically block the offending IP address in the security group when a finding is generated. Which TWO AWS services should the engineer use together to achieve this? (Choose TWO.)

Select 2 answers
A.AWS Lambda
B.AWS Config
C.Amazon Simple Notification Service (SNS)
D.Amazon EventBridge
E.Amazon CloudWatch Logs
AnswersA, D

Lambda can run code to modify security groups based on the finding details.

Why this answer

AWS Lambda is correct because it can execute custom code to modify security group rules, such as removing an offending IP address. Amazon EventBridge is correct because it can capture GuardDuty findings as events and trigger the Lambda function in response to a specific finding type. Together, they enable automated, event-driven remediation without manual intervention.

Exam trap

The trap here is that candidates often choose SNS because it is commonly associated with GuardDuty alerts, but they overlook that SNS cannot perform API actions like modifying security groups—only Lambda or Step Functions can execute the remediation logic.

Full explanation →
74
MCQeasy

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no resources can be created in a specific AWS Region except for the us-east-1 Region. Which policy type should the security team use?

A.IAM permissions boundary
B.IAM policy applied to the root user
C.Resource-based policy
D.Service control policy (SCP)
AnswerD

Service control policies are the correct account-level control because they establish permission guardrails that apply to every IAM principal and the root user in all linked accounts within an AWS Organization. An SCP can deny actions using a condition such as aws:RequestedRegion, effectively preventing users from making API calls in designated Regions across the entire organization. SCPs do not grant permissions themselves; they just set the maximum allowed access, and they do not affect the management account, which is an important nuance when designing Region restrictions.

Why this answer

Service control policies (SCPs) are the correct choice because they allow you to centrally control the maximum available permissions for all accounts in an AWS Organization. By applying an SCP that denies all actions in a specific region (except us-east-1), the security team can enforce a region restriction across all member accounts, regardless of any IAM policies attached to users or roles. SCPs do not grant permissions themselves but act as a guardrail that limits what IAM policies can allow.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking that a simple IAM policy denying region access can achieve the same result, but SCPs are the only mechanism that can enforce restrictions across all users and roles in multiple accounts within an organization.

How to eliminate wrong answers

Option A is wrong because IAM permissions boundaries set the maximum permissions for an IAM user or role within a single account, but they cannot enforce region restrictions across multiple accounts in an organization. Option B is wrong because an IAM policy applied to the root user only affects the root user of a single account and does not scale to all accounts in the organization; also, AWS recommends against using root user credentials for daily operations. Option C is wrong because resource-based policies are attached to individual resources (e.g., S3 buckets, Lambda functions) and control access to that specific resource, not the ability to create resources in a region across an entire account or organization.

Full explanation →
75
MCQhard

A security engineer applies the above S3 bucket policy. An application tries to upload an object with the header "x-amz-server-side-encryption: AES256". What will happen?

A.The upload succeeds because the policy allows SSE-S3.
B.The upload fails because the encryption header does not match 'aws:kms'.
C.The upload succeeds because the object is encrypted.
D.The upload fails because the header is missing.
AnswerB

The first statement denies non-KMS encryption headers.

Why this answer

The first condition in the S3 bucket policy denies PutObject if the encryption header is not "aws:kms" (using StringNotEquals). Since the application sends "x-amz-server-side-encryption: AES256", which is not "aws:kms", the deny condition is triggered. The second condition denies if the header is missing, but here it is present, so it does not apply.

Therefore, the upload is denied.

Full explanation →

Page 1 of 6

Page 2

All pages

123456

Practice SCS-C02 by domain

Target a specific domain to shore up weak areas.

Threat Detection and Incident ResponseSecurity Logging and MonitoringIdentity and Access ManagementManagement and Security GovernanceInfrastructure SecurityData Protection
See all domains with question counts →