Knowledge + Practice

AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 76–150

376 questions total · 6pages · All types, answers revealed

Take a mock exam Exam hub

Page 2 of 6

76

MCQeasy

A company needs to ensure that data in transit between an EC2 instance and an RDS database is encrypted. Which solution meets this requirement?

A.Use a VPN connection between the VPC and the database

B.Enable encryption at rest on the RDS instance

C.Enable SSL/TLS on the database connection

D.Use client-side encryption on the application

AnswerC

SSL/TLS encrypts data in transit.

Why this answer

SSL/TLS is the appropriate solution to encrypt data in transit between the EC2 instance and the RDS database. It ensures that data is encrypted during transmission, preventing eavesdropping or tampering. Option A is incorrect because a VPN connection encrypts traffic between networks but is unnecessary for direct connectivity within the same VPC; SSL/TLS is more straightforward.

Option B is incorrect because encryption at rest protects data stored on disk, not data in motion. Option D is incorrect because client-side encryption would require modifying the application to encrypt data before sending, which does not guarantee encryption of the entire communication channel.

Full explanation →

77

MCQmedium

A company needs to protect sensitive data in Amazon S3 from accidental deletion or overwriting. The data must be retained for at least 7 years after creation. Which combination of S3 features should be used?

A.Enable S3 Versioning and enable S3 Object Lock in Compliance mode

B.Use S3 Intelligent-Tiering and lifecycle policies

C.Enable S3 Versioning and MFA Delete

D.Enable S3 Object Lock in Governance mode and configure a lifecycle policy to expire objects after 7 years

AnswerD

Object Lock in Governance mode prevents deletion and overwriting during the retention period, and a lifecycle policy can expire objects after exactly 7 years, satisfying the requirement.

Why this answer

S3 Object Lock in Governance mode prevents objects from being deleted or overwritten during the retention period, and a lifecycle policy can automatically expire objects after 7 years to meet the retention requirement. Option A is incorrect because Object Lock in Compliance mode also prevents deletion and overwriting, but without specifying a retention period, it does not enforce the 7-year retention; additionally, Compliance mode cannot be overridden, which may be too restrictive. Option B is incorrect because S3 Intelligent-Tiering and lifecycle policies manage storage costs and transitions, not protection against deletion or overwriting.

Option C is incorrect because versioning and MFA Delete protect against accidental deletion and preserve overwritten versions, but do not guarantee a 7-year retention period; lifecycle policies would be needed to enforce it.

Full explanation →

78

MCQhard

A company is using AWS Transit Gateway to connect multiple VPCs and on-premises networks. The Security Engineer needs to ensure that traffic between VPCs is inspected by a central network appliance. Which architecture should the Engineer implement?

A.Use Transit Gateway with appliance mode enabled on the attachments to the inspection VPC, and route inter-VPC traffic through the inspection VPC.

B.Use VPC Peering connections between all VPCs and route traffic through the inspection VPC.

C.Place the network appliance in a public subnet of the inspection VPC and use internet gateways for routing.

D.Use Transit Gateway with route tables that point to the network appliance's ENI for all inter-VPC traffic.

AnswerA

Transit Gateway appliance mode on the attachments to the inspection VPC is the correct approach because it enables the Transit Gateway to forward packets to the network appliance even when return traffic would enter through a different attachment or follow a different path. This is critical for stateful appliances that must inspect both directions of a connection. Inter-VPC traffic is routed via TGW route tables to the inspection VPC attachment, and the appliance's ENI is the next hop inside that VPC. Without appliance mode, asymmetric routing could cause the appliance or the Transit Gateway to drop packets.

Why this answer

Enabling appliance mode on the Transit Gateway attachments to the inspection VPC forces the Transit Gateway to preserve the source and destination MAC addresses of packets, ensuring that asymmetric routing does not cause the network appliance to drop traffic. By routing inter-VPC traffic through the inspection VPC, the appliance can inspect all packets, and appliance mode ensures that return traffic is sent back through the same appliance, maintaining stateful inspection.

Exam trap

The trap here is that candidates often assume that simply routing traffic through an inspection VPC via Transit Gateway is sufficient, without understanding that appliance mode is required to prevent asymmetric routing and ensure stateful inspection works correctly.

How to eliminate wrong answers

Option B is wrong because VPC Peering does not support transitive routing; each peering connection is a one-to-one relationship, so traffic cannot be routed through a central inspection VPC without creating a full mesh of connections and complex routing. Option C is wrong because placing the appliance in a public subnet with an internet gateway would expose it to the internet and is not designed for private inter-VPC traffic inspection; internet gateways are for internet-bound traffic, not VPC-to-VPC routing. Option D is wrong because simply pointing route tables to the network appliance's ENI does not enable appliance mode; without appliance mode, the Transit Gateway may perform MAC address rewriting, causing asymmetric routing and stateful inspection failures.

Full explanation →

79

MCQmedium

A company wants to allow users from an external AWS account to assume an IAM role in its account. What must be configured in both accounts?

A.An IAM password policy in both accounts.

B.Only the trusting account's role trust policy.

C.Only the external account's IAM policy to allow sts:AssumeRole.

D.Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole.

AnswerD

Correct. Both the trusting account's role trust policy and the external account's IAM policy to allow sts:AssumeRole are required for cross-account role access.

Why this answer

Cross-account role access requires configuration on both sides: the trusting account (where the role resides) must have a trust policy that allows the external account to assume the role, and the external account must have an IAM policy that grants its users permission to call sts:AssumeRole targeting that role. Option A is incorrect because an IAM password policy is unrelated to cross-account role access. Option B is incorrect because while the trusting account's trust policy is necessary, the external account also needs to grant sts:AssumeRole permission to its users.

Option C is incorrect because the external account's policy alone is insufficient without the trusting account's trust policy.

Full explanation →

80

MCQmedium

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance is associated with a security group that allows outbound HTTPS (port 443) to 0.0.0.0/0. The private subnet route table has a default route (0.0.0.0/0) pointing to a NAT Gateway in the public subnet. The NAT Gateway's security group allows inbound HTTPS from the private subnet CIDR. However, the instance cannot download patches. What is the most likely cause?

A.The network ACL for the private subnet is blocking outbound traffic

B.The NAT Gateway's security group is blocking outbound traffic to the internet

C.The private subnet route table does not have a route to the NAT Gateway

D.The security group attached to the EC2 instance is blocking inbound traffic

AnswerB

NAT Gateway's security group must allow outbound HTTPS to 0.0.0.0/0.

Why this answer

The NAT Gateway's security group must allow outbound traffic to the internet for the patches to be retrieved. Even though the NAT Gateway allows inbound HTTPS from the private subnet, it also needs an outbound rule permitting HTTPS traffic to 0.0.0.0/0 so that response packets from the internet can flow back through the NAT Gateway to the instance. Without this outbound rule, the NAT Gateway drops the return traffic, preventing the download.

Exam trap

The trap here is that candidates assume the NAT Gateway only needs inbound rules from the private subnet, forgetting that outbound rules are required for return traffic, or they mistakenly think NAT Gateways cannot have security groups at all.

How to eliminate wrong answers

Option A is wrong because the network ACL for the private subnet is not mentioned as blocking traffic; by default, network ACLs allow all inbound and outbound traffic, and the question does not indicate any custom ACL rules that would block outbound HTTPS. Option C is wrong because the private subnet route table already has a default route (0.0.0.0/0) pointing to the NAT Gateway, so routing to the NAT Gateway is correctly configured. Option D is wrong because the security group attached to the EC2 instance allows outbound HTTPS to 0.0.0.0/0, which is sufficient for the instance to initiate the connection; inbound traffic is not relevant for outbound patch downloads.

Full explanation →

81

MCQhard

Refer to the exhibit. A security engineer applied the bucket policy shown. What is the effect of this policy?

A.All PutObject requests are denied.

B.Only GetObject requests that use HTTP are denied.

C.Only GetObject requests from specific IP ranges are denied.

D.All GetObject requests to the bucket are denied.

AnswerB

Correct. The policy denies GetObject requests when aws:SecureTransport is false (HTTP).

Why this answer

The bucket policy includes a Deny statement for s3:GetObject requests that are not using HTTPS. The condition `aws:SecureTransport` is set to false, meaning the request is over HTTP. Therefore, any GetObject request made over HTTP is denied.

PutObject requests are not affected, and GetObject requests over HTTPS are allowed regardless of IP address.

Exam trap

The trap here is that candidates overlook the `Null` condition on `aws:SecureTransport` and assume the `NotIpAddress` condition alone denies all requests from outside the IP range, missing that the policy only triggers when the request is over HTTP.

How to eliminate wrong answers

Option A is wrong because the policy only denies `s3:GetObject`, not `s3:PutObject`, so PutObject requests are not denied. Option C is wrong because the policy denies requests from IPs outside the specified range only when the request uses HTTP; it does not deny requests from specific IP ranges—it denies requests not from that range, but only under the HTTP condition. Option D is wrong because the policy does not deny all GetObject requests; it only denies those made over HTTP, leaving HTTPS GetObject requests unaffected.

Full explanation →

82

MCQmedium

A security engineer notices that an EC2 instance in a private subnet is able to make outbound connections to the internet. The instance does not have a public IP, and there is no NAT gateway or instance in the VPC. What is the most likely cause?

A.The VPC has an egress-only internet gateway for IPv6 traffic.

B.The instance has a public IP assigned automatically via Auto-assign Public IP.

C.The instance is using a VPC endpoint (Gateway type) for S3.

D.The subnet's route table has a default route (0.0.0.0/0) pointing to an internet gateway.

AnswerA

An egress-only internet gateway (EIGW) is an IPv6-specific VPC component that enables instances with IPv6 addresses to initiate outbound connectivity to the internet, but it blocks all inbound connections from the internet. Because an EIGW is completely independent of IPv4 addressing, an instance can reside in a private subnet without a public IPv4 address and still reach the internet via a route table entry for ::/0 pointing to the EIGW. In this scenario, the observed internet access is therefore consistent with the VPC having an egress-only internet gateway for IPv6 traffic.

Why this answer

An egress-only internet gateway (EIGW) allows outbound IPv6 traffic from instances in a private subnet without requiring a public IPv4 address or NAT. Since the instance is making outbound connections to the internet and has no public IP or NAT, and the VPC likely has IPv6 enabled, the EIGW is the most plausible cause. Option D is incorrect because a default route to an internet gateway requires the instance to have a public IPv4 address for return traffic, which contradicts the scenario.

Exam trap

The trap here is that candidates assume a private subnet inherently blocks internet access, but the question tests whether they understand that a subnet's route table—not its public/private designation—determines outbound connectivity, and a 0.0.0.0/0 route to an IGW makes it a public subnet regardless of the instance's IP assignment.

How to eliminate wrong answers

Option A is wrong because an egress-only internet gateway (EIGW) only supports IPv6 traffic, and the question does not mention IPv6; it would not enable outbound IPv4 connections. Option B is wrong because the instance does not have a public IP, and Auto-assign Public IP only applies at launch; even if enabled, the instance would have a public IP, contradicting the premise. Option C is wrong because a VPC Gateway Endpoint for S3 only provides private connectivity to S3, not general internet access; it cannot route traffic to arbitrary internet destinations.

Full explanation →

83

MCQeasy

A security engineer finds this IAM policy attached to a user. The user is able to create CloudTrail trails but cannot start logging. What is the MOST likely reason?

A.The user lacks `iam:PassRole` permission for the CloudTrail service role.

B.The `StartLogging` action is not listed in the policy.

C.The policy does not specify the `cloudtrail:StartLogging` action.

D.The user does not have permission to create CloudTrail trails.

AnswerA

Starting logging requires passing an IAM role to CloudTrail.

Why this answer

The user can create CloudTrail trails but cannot start logging because starting logging requires the `iam:PassRole` permission to pass the CloudTrail service role to the CloudTrail service. Without this permission, CloudTrail cannot assume the role needed to write logs to the S3 bucket and deliver them to CloudWatch Logs, even though the user has `cloudtrail:CreateTrail` and `cloudtrail:StartLogging` actions in the policy.

Exam trap

The trap here is that candidates focus on the missing `cloudtrail:StartLogging` action in the policy, but the real issue is the missing `iam:PassRole` permission, which is a common oversight when configuring CloudTrail permissions.

How to eliminate wrong answers

Option B is wrong because the `StartLogging` action is not a permission; it is an API call, and the policy likely includes `cloudtrail:StartLogging` as an action, but the issue is the missing `iam:PassRole`. Option C is wrong because the policy does not need to specify `cloudtrail:StartLogging` as a separate action if it is already included; the problem is the missing `iam:PassRole` permission, not the absence of the action. Option D is wrong because the user is able to create CloudTrail trails, which directly contradicts the claim that they lack permission to create trails.

Full explanation →

84

MCQhard

A company uses a multi-account AWS Organizations setup with hundreds of accounts. The security team uses AWS Security Hub in the management account to aggregate findings from all accounts. They have configured Amazon GuardDuty in all accounts and enabled AWS Config with recording. Recently, they noticed that Security Hub is not displaying any findings from GuardDuty in member accounts, even though GuardDuty is generating sample findings. The security team has verified that the Security Hub integration with GuardDuty is enabled in the management account. What is the most likely reason for the missing findings?

A.The IAM role for Security Hub in the management account lacks permissions to read findings from member accounts.

B.AWS Security Hub is not enabled in the member accounts.

C.Amazon GuardDuty is not enabled in the member accounts.

D.The member accounts have not enabled the integration between GuardDuty and Security Hub.

AnswerD

Each member account must enable the integration to forward findings to Security Hub.

Why this answer

In a multi-account AWS Organizations setup, Security Hub in the management account aggregates findings from member accounts only if each member account has explicitly enabled the integration between GuardDuty and Security Hub. Even if GuardDuty is generating sample findings in member accounts, Security Hub will not display those findings unless the member account has enabled the GuardDuty-to-SecurityHub integration (via the Security Hub console or API). The management account enabling the integration does not automatically propagate the integration to member accounts.

Exam trap

The trap here is that candidates assume enabling the integration in the management account automatically propagates to all member accounts, but AWS requires each member account to explicitly enable the GuardDuty-to-SecurityHub integration for findings to be forwarded.

How to eliminate wrong answers

Option A is wrong because Security Hub in the management account uses AWS Organizations' trusted access and the AWSServiceRoleForSecurityHub service-linked role to read findings from member accounts; no additional IAM role permissions are required for cross-account reading of findings. Option B is wrong because Security Hub must be enabled in member accounts to receive findings, but the question states that Security Hub is aggregating findings from all accounts, implying it is enabled in member accounts; the issue is specifically about GuardDuty findings not appearing. Option C is wrong because the question explicitly states that GuardDuty is generating sample findings in member accounts, confirming GuardDuty is enabled and functioning in those accounts.

Full explanation →

85

Multi-Selecthard

A company needs to protect data in Amazon S3 by ensuring that only authorized users can access objects, and all access is logged. Which TWO services should be used together? (Choose TWO.)

Select 2 answers

A.AWS Identity and Access Management (IAM)

B.AWS CloudTrail

C.AWS KMS

D.AWS WAF

E.Amazon CloudWatch

AnswersA, B

IAM policies define who can access S3 objects.

Why this answer

AWS Identity and Access Management (IAM) is correct because it enables you to define granular permissions for S3 objects, ensuring that only authorized users or roles can access them via IAM policies or S3 bucket policies. AWS CloudTrail is correct because it logs all API calls made to S3, including object-level operations like GetObject and PutObject, providing an audit trail for access. Together, they satisfy the requirement of controlling access and logging all access.

Exam trap

The trap here is that candidates often confuse AWS KMS with access control because encryption is related to data protection, but KMS does not authorize user access or log access events, which are the core requirements in this question.

Full explanation →

86

MCQhard

A company has a requirement that all Amazon EC2 instances must be launched with an IAM role that grants least-privilege permissions. The security team wants to prevent users from launching instances without a role, and also want to ensure that the role used is one of a set of approved roles. How can this be enforced?

A.Use an SCP to require that all EC2 instances have an IAM role attached.

B.Attach an IAM policy to users that denies ec2:RunInstances unless the ec2:InstanceProfile condition matches an approved profile ARN.

C.Use an SCP to deny ec2:RunInstances unless the instance profile is in a specific list of ARNs.

D.Use AWS Config to detect instances without a role and automatically terminate them.

AnswerB

This policy condition ensures that only instances with an approved IAM role can be launched.

Why this answer

Option B uses an IAM policy with a condition on the ec2:InstanceProfile key to ensure that only approved instance profiles are used. This satisfies both requirements: a role must be attached, and it must be one of the approved roles.

Option A is incorrect because an SCP that requires an IAM role cannot restrict the role to a specific set of approved roles; it would allow any role.

Option C is incorrect because SCPs require AWS Organizations and apply to all principals in the account. While SCPs can technically use the ec2:InstanceProfile condition key, they are typically used for broad guardrails and not for user-specific restrictions. An IAM policy with a condition is the recommended method for this use case.

Option D is incorrect because AWS Config is a detective service; it cannot prevent unauthorized launches, only detect them after the fact.

Full explanation →

87

Multi-Selecthard

A security engineer is designing a solution to allow an external auditor to access logs in an S3 bucket in the company's AWS account. The auditor does not have an AWS account. The engineer needs to grant read-only access to the specific bucket for a limited time. Which TWO actions should the engineer take? (Choose two.)

Select 2 answers

A.Enable S3 Access Analyzer on the bucket to generate findings for the auditor.

B.Create a cross-account IAM role in the company's account and share the role ARN with the auditor.

C.Use AWS STS to issue temporary credentials that the auditor can use to access the bucket.

D.Generate a pre-signed URL for each log file the auditor needs to access.

E.Configure the bucket policy to grant access to 'Principal': '*' with a condition that limits access to the auditor's IP address.

AnswersC, D

STS can issue temporary credentials with a specified expiration; the auditor can use these to access the bucket.

Why this answer

AWS Security Token Service (STS) can issue temporary, limited-privilege credentials (access key, secret key, and session token) that the auditor can use to authenticate API requests to the S3 bucket. This approach does not require the auditor to have an AWS account and allows the engineer to control the validity period (via the DurationSeconds parameter) to enforce a limited time window. Option D is correct because a pre-signed URL embeds temporary credentials and a specific expiration time, granting read-only access to a single object without requiring the auditor to have AWS credentials or an AWS account.

Exam trap

The trap here is that candidates often choose cross-account IAM roles (Option B) without realizing that the external user must have an AWS account to assume the role, which is explicitly not the case in this scenario.

Full explanation →

88

MCQhard

A company uses AWS CloudTrail to log all API calls across multiple accounts in AWS Organizations. The security team notices that management events are being logged, but data events for Amazon S3 are not appearing in the CloudTrail logs for any account. The team needs to enable data event logging for S3 across all accounts. Currently, the organization trail is configured in the management account, and all member accounts have default CloudTrail configurations. What is the MOST efficient way to enable S3 data event logging for all current and future accounts in the organization?

A.Ask each member account to create a new trail in their own account with S3 data events enabled.

B.Update the existing organization trail's event selectors in the management account to include S3 data events for all accounts.

C.Enable S3 server access logging on all S3 buckets across the organization and aggregate logs in a central S3 bucket.

D.Create a new organization trail in the management account with S3 data events enabled, and share it with member accounts.

AnswerB

In the management account, edit the existing organization trail and update its event selectors to include S3 data events, choosing 'All S3 buckets' for object-level operations such as GetObject, PutObject, and DeleteObject. CloudTrail propagates this configuration to every member account, so all current and future accounts are captured automatically without per-account changes. This is the intended, least-effort method and keeps delivery centralized in the original destination bucket.

Why this answer

An organization trail in the management account can have its event selectors updated to include S3 data events for all accounts in the organization. This change automatically applies to all existing and future member accounts, as organization trails are replicated to all accounts by AWS CloudTrail. No additional configuration is needed in member accounts, making it the most efficient approach.

Exam trap

The trap here is that candidates may think they need to create a new organization trail or involve member accounts, but the most efficient solution is to update the existing organization trail's event selectors, which automatically applies to all current and future accounts.

How to eliminate wrong answers

Option A is wrong because asking each member account to create a separate trail is inefficient and does not scale for future accounts; it also duplicates effort and log storage. Option C is wrong because S3 server access logging logs object-level access requests (e.g., GET, PUT) but is not CloudTrail data event logging; it does not integrate with CloudTrail's event history or organization-wide trails. Option D is wrong because you cannot 'share' a trail with member accounts; organization trails are created in the management account and automatically applied to all accounts in the organization—creating a new trail is unnecessary when the existing organization trail can be updated.

Full explanation →

89

MCQhard

A company uses Amazon Route 53 for DNS and wants to log all DNS queries made from its VPC. The logs must be stored in Amazon S3 for compliance purposes. Which solution meets these requirements?

A.Enable Route 53 Resolver query logging and publish to an S3 bucket.

B.Install a CloudWatch Logs agent on each EC2 instance and configure it to send DNS logs to CloudWatch Logs.

C.Enable AWS CloudTrail for DNS API calls and deliver to an S3 bucket.

D.Enable VPC Flow Logs and publish to an S3 bucket.

AnswerA

Route 53 Resolver query logging captures DNS queries made by resources in your VPC and can deliver logs to S3.

Why this answer

Route 53 Resolver query logging is the native AWS feature designed to capture DNS queries that originate from resources within a VPC. By enabling this feature and specifying an S3 bucket as the destination, you can log all DNS queries made by EC2 instances, Lambda functions, and other VPC resources without needing any additional agents or configuration. This directly meets the requirement for storing DNS query logs in S3 for compliance.

Exam trap

The trap here is confusing data-plane DNS query logs (Route 53 Resolver query logging) with control-plane API logs (CloudTrail) or network flow logs (VPC Flow Logs), leading candidates to select options that log the wrong type of information for the stated requirement.

How to eliminate wrong answers

Option B is wrong because installing a CloudWatch Logs agent on each EC2 instance captures only the DNS queries made by that specific instance's operating system, not all DNS queries from the VPC (e.g., queries from other services or from the Route 53 Resolver itself), and it requires manual agent management. Option C is wrong because AWS CloudTrail logs API calls made to Route 53 (e.g., creating hosted zones), not the DNS query traffic itself; DNS queries are data-plane operations, not control-plane API calls. Option D is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) but do not log the content or queries of DNS traffic; they cannot provide the actual DNS query names or types.

Full explanation →

90

MCQhard

During an incident response, a security engineer needs to preserve the state of an EC2 instance for forensic analysis. The instance is running a production workload that cannot be interrupted. Which of the following actions should the engineer take FIRST to ensure data integrity?

A.Run the dd command to clone the root volume to another EBS volume.

B.Create an AMI from the instance while it is running.

C.Take a snapshot of the attached EBS volumes while the instance is running.

D.Use AWS Systems Manager Run Command to create a memory dump and store it in S3.

AnswerD

AWS Systems Manager Run Command can invoke a memory acquisition utility on the live instance, such as one using the Linux kernel module LiME, to copy the contents of RAM to an EBS volume or S3 without requiring a reboot or instance stop. This preserves volatile evidence like loaded kernel modules, open network sockets, and running processes, which are essential for determining the scope of compromise. Storing the memory dump in S3 protects chain of custody if versioning and object lock are enabled, and it does not alter the underlying disk volumes.

Why this answer

During an incident response, preserving volatile data (such as memory contents) is critical before any other action that might alter the system state. AWS Systems Manager Run Command can execute a command (e.g., using `dd` or `LiME`) to capture a memory dump and store it in Amazon S3 without interrupting the production workload. This ensures that forensic artifacts like running processes, network connections, and encryption keys are preserved before any disk-level operations that could overwrite or modify evidence.

Exam trap

The trap here is that candidates often prioritize disk-level preservation (snapshots or AMIs) as the first step, forgetting that volatile memory contains critical evidence that is lost the moment the instance is stopped or snapshotted, and that AWS Systems Manager can capture this data without interrupting the workload.

How to eliminate wrong answers

Option A is wrong because running the `dd` command to clone the root volume to another EBS volume requires the volume to be unmounted or in a consistent state; doing so on a running production instance can cause data corruption or I/O errors, and it does not capture volatile memory. Option B is wrong because creating an AMI from a running instance without first freezing the filesystem (e.g., using `fsfreeze`) can result in an inconsistent image due to ongoing writes, and it does not capture memory contents. Option C is wrong because taking a snapshot of attached EBS volumes while the instance is running does not guarantee crash consistency unless all volumes are snapshotted simultaneously (multi-volume snapshot), and it still fails to preserve volatile memory data that is essential for forensic analysis.

Full explanation →

91

MCQeasy

A company requires that all access to its S3 buckets be logged for compliance. Which AWS service should be used to record API calls to S3?

A.Amazon GuardDuty

B.Amazon Inspector

C.AWS Config

D.AWS CloudTrail

AnswerD

AWS CloudTrail records API calls for auditing purposes.

Why this answer

AWS CloudTrail records API calls for auditing purposes, making it the correct service for logging access to S3 buckets. Option A is incorrect because Amazon GuardDuty is a threat detection service, not a logging service. Option B is incorrect because Amazon Inspector assesses vulnerabilities.

Option C is incorrect because AWS Config tracks resource configuration changes, not API calls.

Full explanation →

92

MCQeasy

A Security Engineer needs to block SSH traffic (port 22) from the internet to all EC2 instances in a VPC. Which approach is the most secure and scalable?

A.Add a security group rule to deny inbound traffic on port 22 from 0.0.0.0/0.

B.Add a network ACL rule to deny inbound traffic on port 22 from 0.0.0.0/0 at the subnet level.

C.Add a network ACL rule to allow inbound traffic on port 22 from 0.0.0.0/0 and then add a deny rule for the same traffic.

D.Add a security group rule to block inbound traffic on port 22 from 0.0.0.0/0 at the VPC level.

AnswerB

A network ACL (NACL) is a stateless firewall applied at the subnet level, and it explicitly supports both allow and deny rules. By adding a deny rule for inbound TCP port 22 from 0.0.0.0/0 with a low rule number, you block all SSH traffic from any source from entering the subnet. This is the correct method because security groups cannot provide an explicit deny, and the NACL rule operates at the subnet boundary rather than at individual resources.

Why this answer

Network ACLs (NACLs) are stateless and operate at the subnet level, allowing you to explicitly deny inbound SSH traffic from 0.0.0.0/0. This approach is more secure and scalable than security group rules because NACLs can block traffic before it reaches the instance, and they support explicit deny rules, which security groups do not. Security groups only support allow rules, so you cannot add a deny rule to block SSH traffic; you must omit the allow rule, which is less explicit and can be accidentally overridden.

Exam trap

The trap here is that candidates often confuse security groups with network ACLs, assuming security groups can have explicit deny rules, when in fact only NACLs support deny rules and operate at the subnet level.

How to eliminate wrong answers

Option A is wrong because security groups do not support deny rules; they only support allow rules, so adding a 'deny' rule is syntactically invalid and cannot be implemented. Option C is wrong because NACLs evaluate rules in order by rule number, and an allow rule with a lower number would permit the traffic before a deny rule with a higher number is evaluated, making the deny ineffective; additionally, allowing then denying the same traffic is redundant and not a best practice. Option D is wrong because security groups cannot be applied at the VPC level; they are associated with individual ENIs or instances, not the entire VPC, and they do not support deny rules.

Full explanation →

93

Multi-Selectmedium

Which THREE actions should be taken when preserving forensic evidence from an EC2 instance during an incident? (Select THREE.)

Select 3 answers

A.Reboot the instance to clear any malicious processes.

B.Create an EBS snapshot of all volumes.

C.Terminate the instance to prevent further compromise.

D.Capture a memory dump using a tool like LiME.

E.Detach the instance from the network by modifying the security group.

AnswersB, D, E

Snapshots preserve the disk state at a point in time.

Why this answer

Creating an EBS snapshot preserves the exact state of the volume at the time of the incident, including any malicious files, logs, or artifacts. This snapshot can be used for offline forensic analysis without altering the original evidence. AWS recommends this as a first step in forensic acquisition to maintain chain of custody.

Exam trap

The SCS-C02 exam often tests the misconception that rebooting or terminating an instance is a safe containment step, but in forensic contexts these actions destroy volatile evidence and should be avoided until after memory and disk acquisition.

Full explanation →

94

MCQhard

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The security team wants to ensure that if the EC2 instance is compromised, the attacker cannot use the role credentials to access resources outside the account. What should the security team do?

A.Store the role credentials in AWS Secrets Manager and rotate them frequently.

B.Use an instance profile with a short-lived session token.

C.Use an SCP to deny all actions except S3 access for the role.

D.Attach a permissions boundary to the IAM role that limits access to only the required S3 bucket.

AnswerD

Permissions boundaries set the maximum permissions for the role.

Why this answer

Using a permissions boundary restricts the maximum permissions the role can have, limiting the impact of a compromised instance.

Full explanation →

95

MCQmedium

A security engineer is designing a monitoring solution for an AWS Lambda function that processes sensitive data. The function occasionally fails due to timeouts. The engineer needs to be alerted immediately when the function fails and also wants to analyze the error logs. Which combination of services should the engineer use?

A.Amazon CloudWatch Logs and Amazon Kinesis Data Firehose

B.Amazon CloudWatch Logs and CloudWatch Alarms with Amazon SNS

C.AWS CloudTrail and Amazon SNS

D.AWS Config and Amazon SNS

AnswerB

CloudWatch Logs stores logs, and CloudWatch Alarms trigger SNS notifications on errors.

Why this answer

Amazon CloudWatch Logs captures the Lambda function's execution logs, including timeout errors, and CloudWatch Alarms can monitor specific metrics like `Errors` or `Throttles` for the function. When the alarm state is triggered (e.g., `ALARM`), it publishes a notification to an Amazon SNS topic, which can send immediate alerts via email, SMS, or other endpoints. This combination provides both real-time alerting and log analysis for troubleshooting.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API activity) with CloudWatch Logs (which captures application logs), leading them to choose Option C, even though CloudTrail cannot capture runtime errors like timeouts.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is designed for streaming data ingestion into storage or analytics services, not for real-time alerting; it lacks the ability to trigger immediate notifications based on Lambda function failures. Option C is wrong because AWS CloudTrail records API calls (e.g., Invoke, UpdateFunctionConfiguration) but does not capture function execution logs or runtime errors like timeouts; it is not suitable for analyzing application-level error logs. Option D is wrong because AWS Config tracks resource configuration changes and compliance, not function execution errors or logs; it cannot alert on runtime failures like timeouts.

Full explanation →

96

MCQmedium

Refer to the exhibit. A security engineer finds this CloudTrail log entry. What is the most significant security concern indicated by this event?

A.The security group rule allows SSH access from any IP address (0.0.0.0/0).

B.The event is a normal administrative action and poses no security concern.

C.The user did not have MFA enabled when assuming the AdminRole.

D.The source IP address (203.0.113.5) is from an unusual location.

AnswerA

This exposes the instance to the internet on port 22.

Why this answer

The CloudTrail log entry shows an `AuthorizeSecurityGroupIngress` API call that adds a rule allowing SSH (port 22) from 0.0.0.0/0. This is a critical security concern because it exposes the EC2 instance to SSH access from any IP address on the internet, creating a high risk of brute-force attacks, unauthorized access, and potential compromise. Security best practices mandate restricting SSH access to specific trusted IP ranges, not the entire internet.

Exam trap

The trap here is that candidates may focus on the source IP address or MFA status, but the core security concern is the overly permissive security group rule that grants unrestricted SSH access to the internet.

How to eliminate wrong answers

Option B is wrong because the event is not a normal administrative action; it explicitly opens SSH to the world, which is a significant security risk and should be flagged as a concern. Option C is wrong because the CloudTrail log does not indicate whether MFA was enabled or not; the event shows the user assumed the AdminRole, but MFA status is not recorded in this log entry, so it cannot be concluded as a security concern from this event alone. Option D is wrong because the source IP address 203.0.113.5 is a documentation/test IP range (RFC 5737) and is not necessarily unusual; more importantly, the security concern is the open SSH rule, not the source IP of the API call.

Full explanation →

97

Multi-Selectmedium

A security engineer needs to ensure that all API calls in an AWS account are logged and that the logs are encrypted at rest and retained for at least 7 years. Which THREE steps should the engineer take? (Choose THREE.)

Select 3 answers

A.Configure CloudTrail to deliver logs to Amazon S3 Glacier.

B.Set an S3 lifecycle policy to transition logs to Glacier after 7 years.

C.Enable S3 Cross-Region Replication to a bucket in another region.

D.Enable S3 default encryption on the log bucket.

E.Enable CloudTrail in the account.

AnswersB, D, E

Retains logs for 7 years.

Why this answer

To ensure all API calls are logged, encrypted at rest, and retained for at least 7 years, the correct steps are: E. Enable CloudTrail in the account to capture API calls; D. Enable S3 default encryption on the log bucket to encrypt logs at rest; and B.

Set an S3 lifecycle policy to transition logs to Glacier after 7 years for long-term retention. Option A is incorrect because CloudTrail cannot deliver logs directly to Glacier; it delivers to an S3 bucket first. Option C is incorrect because Cross-Region Replication helps with geographic redundancy but does not address retention or encryption.

Full explanation →

98

MCQhard

A company is designing a network architecture for a critical application that must meet strict compliance requirements. The application consists of Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The instances need to access an Amazon RDS database in a different VPC. The company wants to minimize exposure to the internet. Which solution should the company use?

A.Use a site-to-site VPN connection between the VPCs.

B.Use a NAT gateway in the database VPC and route traffic through it.

C.Use a VPC Peering connection between the two VPCs.

D.Use an internet gateway and route traffic over the internet with security groups.

AnswerC

A VPC peering connection privately connects two VPCs using AWS's internal backbone, with no traffic traversing the public internet and no need for a public IP address, VPN appliance, or gateway. It creates direct layer-3 route table entries between the VPC CIDRs, and because the relationship is native to AWS, traffic stays isolated from external carriers. For a single application-to-database pair with non-overlapping CIDRs, VPC peering is the simplest and most cost-effective way to establish low-latency private connectivity.

Why this answer

VPC Peering establishes a private, direct network connection between two VPCs using AWS's internal infrastructure, with no exposure to the internet. Traffic stays within the AWS global network, meeting strict compliance requirements for minimizing internet exposure. This allows EC2 instances in the application VPC to communicate with the RDS database in the database VPC securely and with low latency, using private IP addresses.

Exam trap

The trap here is that candidates often confuse VPC Peering with site-to-site VPN, thinking VPN is required for cross-VPC connectivity, but VPC Peering is the correct AWS-native solution for private VPC-to-VPC communication without internet exposure.

How to eliminate wrong answers

Option A is wrong because a site-to-site VPN connection is used to connect an on-premises network to a VPC, not to connect two VPCs within AWS; it would introduce internet exposure (via the VPN tunnel over the public internet) and unnecessary complexity. Option B is wrong because a NAT gateway is designed to allow instances in a private subnet to initiate outbound traffic to the internet, not to enable private communication between two VPCs; routing traffic through a NAT gateway would force traffic over the internet and break the requirement to minimize exposure. Option D is wrong because using an internet gateway and routing traffic over the internet with security groups exposes the traffic to the public internet, violating the compliance requirement to minimize internet exposure; security groups alone cannot prevent the inherent risk of internet-based communication.

Full explanation →

99

Multi-Selectmedium

A security engineer is designing a network architecture for a multi-tier application. The web servers must be accessible from the internet, while the application servers must only be accessible from the web servers. Which TWO configurations should be used? (Choose TWO.)

Select 2 answers

A.Configure a NAT gateway in the private subnet for the application servers.

B.Place the web servers in a public subnet with a route to an internet gateway.

C.Use a network ACL on the application subnet to allow inbound traffic from the web subnet's IP range.

D.Place the application servers in a public subnet with a route to an internet gateway.

E.Configure the application servers' security group to allow traffic only from the web servers' security group.

AnswersB, E

This allows internet traffic to reach the web servers.

Why this answer

Placing web servers in a public subnet with a route to an internet gateway allows them to receive inbound traffic from the internet. This is the standard AWS design for internet-facing resources, where the subnet's route table directs 0.0.0.0/0 traffic to an internet gateway, enabling direct communication from the internet.

Exam trap

The trap here is that candidates often confuse network ACLs with security groups, incorrectly assuming that a stateless network ACL with IP-based rules is the correct way to restrict traffic between tiers, when in fact security group references provide a more secure and manageable solution.

Full explanation →

100

MCQmedium

A security team is reviewing IAM roles and policies. They want to ensure that any new IAM role created in the account must include a specific managed policy (e.g., SecurityAudit). What AWS service can enforce this requirement?

A.AWS CloudTrail

B.AWS Config rules

C.Service control policy (SCP) in AWS Organizations

D.IAM permissions boundary

AnswerC

SCPs can deny role creation if required policy is not attached.

Why this answer

AWS CloudTrail logs API calls but does not enforce policies. Option B is incorrect because AWS Config rules can detect noncompliant roles after creation but cannot prevent their creation. Option C is correct because Service Control Policies (SCPs) in AWS Organizations can deny the creation of IAM roles that do not have a specific managed policy attached, using a condition like `aws:RequestedManagedPolicy`.

Option D is incorrect because IAM permissions boundaries limit the maximum permissions a role can have but do not enforce attachment of a specific managed policy.

Full explanation →

101

MCQhard

A company has an S3 bucket that contains sensitive data. The bucket policy allows access only from a specific VPC endpoint. A security engineer notices that objects in the bucket are being deleted by an IAM user from outside the VPC. The engineer checks the bucket policy and confirms that the policy denies access if the request does not come from the VPC endpoint. However, the deletions continue. What is the most likely cause?

A.The bucket policy is missing a Deny statement for the s3:DeleteObject action.

B.The VPC endpoint policy allows the deletion.

C.The IAM user is the bucket owner and the bucket policy does not apply to the owner.

D.The bucket has an ACL that allows the IAM user to delete objects.

AnswerC

Bucket policies do not apply to the account that owns the bucket; IAM policies would need to be used.

Why this answer

The bucket owner (the root user of the AWS account that owns the bucket) is not subject to bucket policies. Since the IAM user is the bucket owner (same account), the bucket policy's deny condition does not restrict their actions. Therefore, the IAM user can delete objects from outside the VPC.

Option A is incorrect because the bucket policy does deny s3:DeleteObject for non-VPC requests; the issue is that the policy does not apply to the owner. Option B is incorrect because the VPC endpoint policy only applies to requests coming through the endpoint, and the user is not using the endpoint. Option D is incorrect because ACLs are not relevant here; even if an ACL allowed the deletion, the bucket policy would typically override it, but again, the policy does not apply to the owner.

Full explanation →

102

MCQmedium

A company uses AWS CloudTrail to log management events. The security team wants to be alerted when an IAM user creates a new access key. Which solution would meet this requirement with the least operational overhead?

A.Create a CloudWatch Logs metric filter on the CloudTrail log group for CreateAccessKey events and set an alarm.

B.Create an Amazon EventBridge rule that matches the CreateAccessKey event and triggers an Amazon SNS notification.

C.Write a Python script that uses the CloudTrail LookupEvents API and run it on a scheduled basis using Amazon EventBridge Scheduler.

D.Develop a custom AWS Lambda function that queries CloudTrail logs in S3 every hour.

AnswerB

EventBridge is the least-overhead, near-real-time option because CloudTrail automatically delivers all management events to the default EventBridge bus without extra configuration. A rule with an event pattern that matches eventSource="iam.amazonaws.com" and eventName="CreateAccessKey" triggers an SNS topic immediately when the API call occurs, enabling instantaneous security notifications. This is fully event-driven and serverless: there is no polling, no custom code, no log parsing, and no separate metric filter to maintain, which makes it the architecturally cleanest solution.

Why this answer

Amazon EventBridge can directly capture CloudTrail API calls (like CreateAccessKey) as events and route them to an SNS topic for notification, requiring no custom code or polling. This serverless, event-driven approach minimizes operational overhead by eliminating the need to manage log groups, metric filters, or scheduled scripts.

Exam trap

The trap here is that candidates often assume CloudWatch Logs metric filters are the standard way to monitor CloudTrail events, but EventBridge is the native, lower-overhead service for reacting to specific API calls in real time without needing to ship logs to CloudWatch Logs first.

How to eliminate wrong answers

Option A is wrong because CloudTrail logs management events to CloudTrail itself, not to a CloudWatch Logs log group by default; you would need to explicitly configure CloudTrail to deliver events to CloudWatch Logs, and then create a metric filter and alarm, which adds unnecessary complexity. Option C is wrong because writing a Python script to call the CloudTrail LookupEvents API on a schedule introduces polling overhead, latency, and maintenance burden compared to the real-time, push-based EventBridge approach. Option D is wrong because developing a custom Lambda function to query CloudTrail logs in S3 every hour is overly complex, introduces at least one hour of delay, and requires managing S3 bucket notifications or scheduled invocations, all of which are unnecessary when EventBridge can react instantly.

Full explanation →

103

Multi-Selectmedium

A security team wants to detect and alert on potential security threats such as compromised instances or malicious activity within their AWS environment. Which TWO AWS services should be used together to provide comprehensive threat detection?

Select 2 answers

A.AWS Security Hub

B.AWS CloudTrail

C.Amazon Inspector

D.AWS Config

E.Amazon GuardDuty

AnswersA, E

Aggregates and prioritizes security findings.

Why this answer

Amazon GuardDuty (Option E) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence feeds. AWS Security Hub (Option A) aggregates findings from GuardDuty and other services, applies automated compliance checks, and enables centralized alerting and response. Together, they provide comprehensive threat detection by combining GuardDuty's raw threat detection with Security Hub's aggregation and orchestration capabilities.

Exam trap

The trap here is that candidates often confuse logging services (CloudTrail, Config) or vulnerability scanners (Inspector) with active threat detection, but GuardDuty and Security Hub are the only pair that provide continuous, intelligent threat monitoring and centralized alerting.

Full explanation →

104

MCQhard

A financial services company uses AWS KMS to encrypt sensitive data. The security team has a requirement to rotate the CMK every 90 days and to maintain a record of all previous key versions for decryption of historical data. The team creates a new CMK every 90 days and manually updates applications to use the new key. This process is error-prone and causes downtime. What is the MOST operationally efficient solution that meets the requirements?

A.Enable automatic key rotation on the existing CMK.

B.Create a new CMK every 90 days and update the alias to point to the new key. Applications reference the alias.

C.Use a CMK with imported key material and rotate the material every 90 days.

D.Continue creating new CMKs but use a script to update the application configuration files.

AnswerB

Creating a new CMK every 90 days and then updating the alias to reference the new key provides a stable abstraction because applications point to the alias, not the key ID. The alias update is immediate and atomic, requiring no application changes, restarts, or downtime; the old CMK remains enabled to decrypt data encrypted under previous keys. This pattern is the recommended AWS KMS approach for custom rotation periods and satisfies crypto-period separation.

Why this answer

It uses aliases to decouple the key identifier from the application configuration. By creating a new CMK every 90 days and updating the alias to point to the new key, applications that reference the alias automatically use the new key without code changes, eliminating downtime. AWS KMS aliases are mutable pointers that can be reassigned to different CMKs, and the old key versions remain available for decryption of historical data.

Exam trap

The trap here is that candidates often confuse automatic key rotation (which only rotates backing keys within the same CMK) with creating a new CMK and using aliases, failing to recognize that automatic rotation does not meet a 90-day schedule and does not create a separate CMK for audit or compliance purposes.

How to eliminate wrong answers

Option A is wrong because automatic key rotation on an existing CMK creates new backing key versions every year (not 90 days) and does not create a new CMK; it only rotates the cryptographic material within the same CMK, which does not meet the 90-day rotation requirement. Option C is wrong because using a CMK with imported key material and rotating the material every 90 days still does not create a new CMK; it only replaces the key material within the same CMK, and the old key material is deleted, preventing decryption of historical data. Option D is wrong because it continues the error-prone manual process of updating application configuration files, which causes downtime and operational overhead, and does not leverage AWS KMS aliases for a seamless transition.

Full explanation →

105

MCQmedium

A company's security policy requires that all S3 buckets be encrypted at rest. An security engineer needs to detect any S3 bucket that does not have default encryption enabled. Which AWS service should the engineer use to continuously monitor and alert on non-compliant buckets?

A.AWS CloudTrail

B.AWS Config

C.AWS Trusted Advisor

D.Amazon GuardDuty

AnswerB

Config can continuously evaluate resource configurations and trigger notifications for non-compliant resources.

Why this answer

AWS Config is the correct service because it provides continuous monitoring and evaluation of your AWS resource configurations against desired policies. You can create an AWS Config rule, such as the managed rule 's3-bucket-default-encryption-enabled', which automatically checks each S3 bucket for the presence of default encryption (SSE-S3 or SSE-KMS) and triggers an alert or remediation action for any non-compliant bucket. This aligns directly with the requirement to detect and alert on buckets lacking encryption at rest.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with AWS Config (which evaluates resource configurations), leading them to choose CloudTrail for monitoring encryption settings when it only records the actions that change encryption, not the current state of encryption on each bucket.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API activity (e.g., PutBucketEncryption calls) but does not continuously evaluate the current configuration state of resources; it is an audit trail, not a compliance checker. Option C is wrong because AWS Trusted Advisor provides one-time or periodic checks for best practices (including S3 bucket permissions) but does not offer continuous, customizable monitoring or alerting for specific encryption settings like default encryption. Option D is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious activity; it does not evaluate resource configurations for compliance with encryption policies.

Full explanation →

106

MCQmedium

A company is using Amazon Route 53 and wants to log DNS queries for investigative purposes. The logs must be stored in a centralized S3 bucket in the security account. What is the MOST efficient way to achieve this?

A.Enable VPC Flow Logs and analyze DNS traffic.

B.Enable CloudWatch Logs for Route 53 and stream to a Lambda function that writes to S3.

C.Configure Route 53 Resolver query logging to deliver to the central S3 bucket.

D.Use a custom Lambda function to poll Route 53 logs and write to S3.

AnswerC

Route 53 Resolver query logging is the native capability that records the full DNS query and response data for queries handled by Route 53 Resolver, including those from VPCs, inbound, and outbound endpoints. It can directly write logs to a central S3 bucket, and using a cross-account bucket policy, you can allow Route 53 in your account to deliver into the consolidated logging bucket. This approach avoids any intermediate compute, scales automatically, and is the most straightforward secure delivery mechanism.

Why this answer

Route 53 Resolver query logging natively supports delivering DNS query logs directly to an S3 bucket, including cross-account S3 buckets, without requiring any intermediate services. This is the most efficient method because it eliminates the need for additional compute resources or manual polling, and it directly satisfies the requirement for centralized logging in the security account.

Exam trap

The trap here is that candidates may confuse VPC Flow Logs (which capture network flows) with DNS query logs, or assume that CloudWatch Logs or Lambda are required for S3 delivery, when Route 53 Resolver query logging can directly write to S3 with minimal configuration.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) but do not log DNS query details such as domain names or query types. Option B is wrong because Route 53 does not natively send logs to CloudWatch Logs; you would need to configure query logging to CloudWatch Logs first, then use a subscription filter to stream to Lambda, which adds unnecessary complexity and cost compared to direct S3 delivery. Option D is wrong because there is no native 'Route 53 logs' API to poll; Route 53 Resolver query logging can be configured to deliver directly to S3, making a custom polling Lambda redundant and inefficient.

Full explanation →

107

Matchingmedium

Match each AWS security tool to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Automated vulnerability assessment

Threat detection service

Centralized security findings aggregation

Investigation and analysis of security issues

Resource configuration monitoring and compliance

Why these pairings

Correct matches: AWS Shield protects against DDoS, AWS WAF filters web traffic, and GuardDuty provides threat detection. Common confusions include swapping Shield with WAF and Inspector with Macie.

Full explanation →

108

MCQmedium

A security engineer is investigating an IAM role that was used to access AWS resources from an external account. The role has a trust policy that allows the external account to assume it. Which of the following is a required step for the external account to use the role?

A.Configure the role to require MFA for the external account.

B.Create a new IAM role in the external account with a trust policy allowing the role's ARN.

C.Add the external account's root user ARN to the role's trust policy.

D.Attach an IAM policy to an IAM user in the external account that allows sts:AssumeRole for the role ARN.

AnswerD

The external user needs permission to assume the role.

Why this answer

To assume a role in another AWS account, the external account must have an IAM user or role with permissions to call the sts:AssumeRole API for the target role ARN. Option D correctly describes this requirement. Option A is incorrect because MFA is not a required step unless specified in the role's trust policy.

Option B is incorrect because the external account does not need to create a new role; it only needs a principal (user or role) with the appropriate permissions. Option C is incorrect because the trust policy is attached to the role in the target account, not the external account.

Full explanation →

109

MCQeasy

A startup is building a web application on AWS and needs to protect sensitive customer data at rest in an Amazon RDS for MySQL database. The compliance team requires that the encryption keys be managed by the company's on-premises hardware security module (HSM) and be rotated every 6 months. Which solution should the startup use?

A.Use AWS CloudHSM to store the encryption keys and enable RDS encryption with CloudHSM.

B.Use AWS KMS with a customer master key (CMK) and import key material from the on-premises HSM.

C.Store the encryption keys in AWS Secrets Manager and use them to encrypt the database.

D.Use AWS KMS with a custom key store backed by AWS CloudHSM.

AnswerA

CloudHSM provides a dedicated HSM that you control, and RDS can be encrypted using keys from CloudHSM.

Why this answer

AWS CloudHSM provides a dedicated hardware security module (HSM) that allows you to manage encryption keys on-premises-style, meeting the requirement for key management on the company's own HSM. When you enable Amazon RDS for MySQL encryption with CloudHSM, the database encryption keys are stored and managed in the CloudHSM cluster, and you can rotate them every 6 months as required. This solution directly satisfies the compliance team's mandate for on-premises HSM key management and periodic rotation.

Exam trap

The trap here is that candidates confuse AWS CloudHSM (a dedicated HSM service where you manage keys directly) with AWS KMS custom key stores (which also use CloudHSM but are managed through KMS), leading them to choose option D, which does not allow the company to manage keys on their own on-premises HSM.

How to eliminate wrong answers

Option B is wrong because AWS KMS with imported key material does not allow the key to be managed by the company's on-premises HSM; the key material is imported into KMS, but the HSM is not used for ongoing key operations or rotation. Option C is wrong because AWS Secrets Manager is a service for storing secrets, not for managing encryption keys for RDS encryption, and it does not integrate with an on-premises HSM for key management. Option D is wrong because a custom key store backed by AWS CloudHSM uses CloudHSM as the key store, but the keys are still managed by AWS KMS, not directly by the company's on-premises HSM, and the compliance team requires the keys to be managed by their own on-premises HSM, not an AWS-managed CloudHSM.

Full explanation →

110

MCQhard

During incident response, a security engineer needs to preserve the state of a running EC2 instance for forensic analysis without losing volatile data. The instance is in an Auto Scaling group. Which action should the engineer take FIRST?

A.Detach the instance from the Auto Scaling group.

B.Stop the instance to preserve its EBS volumes.

C.Take an AMI of the instance immediately.

D.Suspend the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group.

AnswerD

Prevents Auto Scaling from interfering with the instance.

Why this answer

Suspending the `HealthCheck` and `ReplaceUnhealthy` processes on the Auto Scaling group prevents the group from detecting the instance as unhealthy and terminating it while the engineer preserves volatile data. This is the first step to ensure the instance remains running and accessible for forensic collection (e.g., memory dump) before any other actions that could alter its state.

Exam trap

The trap here is that candidates often choose to stop the instance or take an AMI first, not realizing that those actions destroy volatile data or require a stable state, whereas the correct first step is to prevent the Auto Scaling group from interfering with the running instance.

How to eliminate wrong answers

Option A is wrong because detaching the instance from the Auto Scaling group does not prevent the group from launching a replacement instance, but more critically, it does not protect the running instance from being terminated by other processes or manual actions; it also does not preserve volatile data. Option B is wrong because stopping the instance immediately loses volatile data (RAM, network connections, process state) which is critical for forensic analysis; the goal is to preserve the running state, not halt it. Option C is wrong because taking an AMI of the instance requires the instance to be in a stable state (often stopped or with consistent filesystem), and it does not capture volatile memory; it also takes time and could alter the instance state during the snapshot process.

Full explanation →

111

MCQhard

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. Which configuration should the engineer implement?

A.Configure the ALB listener with HTTP protocol and the target group with HTTP protocol, then use a security group to restrict traffic.

B.Configure the ALB listener with HTTPS protocol and the target group with HTTP protocol.

C.Configure the ALB listener with TCP protocol and the target group with TCP protocol, then install SSL certificates on the EC2 instances.

D.Configure the ALB listener with HTTPS protocol and the target group with HTTPS protocol, and install SSL certificates on the EC2 instances.

AnswerD

This encrypts both frontend and backend traffic.

Why this answer

It ensures end-to-end encryption between the ALB and EC2 instances. The ALB listener uses HTTPS to terminate client SSL/TLS, and the target group uses HTTPS to re-encrypt traffic to the instances, requiring SSL certificates on the EC2 instances to decrypt and re-encrypt. This satisfies the security requirement that all traffic between the ALB and EC2 instances be encrypted.

Exam trap

The trap here is that candidates often assume HTTPS on the listener alone is sufficient, overlooking that the target group protocol must also be HTTPS to encrypt traffic between the ALB and instances, not just between clients and the ALB.

How to eliminate wrong answers

Option A is wrong because using HTTP on both the listener and target group means traffic is in plaintext, violating the encryption requirement. Option B is wrong because while the listener uses HTTPS, the target group uses HTTP, so traffic between the ALB and EC2 instances is unencrypted, which does not meet the requirement. Option C is wrong because TCP protocol at the listener and target group does not provide application-layer encryption; SSL certificates on EC2 instances alone do not encrypt traffic without HTTPS configuration on the target group.

Full explanation →

112

MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all API activity across all accounts is logged and immutable. CloudTrail is enabled in all accounts, but the logs are stored in individual account buckets. The team wants to centralize logs and prevent any account from disabling logging. What should they do?

A.Create a new CloudTrail trail for each account and configure S3 bucket policies to allow cross-account access.

B.Enable S3 MFA Delete on each account's log bucket and require MFA for IAM users.

C.Use CloudWatch Logs to aggregate logs and set a retention policy of 10 years.

D.Apply an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail, and create an organization trail that delivers logs to a central S3 bucket with a bucket policy that prevents deletion.

AnswerD

Applying an SCP to the organization root or to all member accounts that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail ensures that even an IAM admin or the root user in a member account cannot disable or delete the trail. An organization trail automatically delivers CloudTrail logs from every account to a designated central S3 bucket, and the bucket policy can explicitly Deny actions such as s3:DeleteBucket, s3:DeleteBucketPolicy, and s3:DeleteObject for all principals, making the log data tamper-proof. This combination provides a centralized, immutable audit record while removing the ability of individual account administrators to interfere with logging. It directly satisfies the requirement to prevent disabling and to protect the integrity of the logs.

Why this answer

It uses an SCP to prevent disabling CloudTrail (denying cloudtrail:StopLogging and cloudtrail:DeleteTrail) and creates an organization trail that delivers logs to a central S3 bucket. The central bucket policy prevents deletion of logs, ensuring immutability and centralized logging across all accounts in the AWS Organization.

Exam trap

The trap here is that candidates often confuse S3 MFA Delete or cross-account bucket policies as sufficient for immutability and centralization, but they fail to address the core requirement of preventing accounts from disabling CloudTrail itself, which requires an SCP or organization trail.

How to eliminate wrong answers

Option A is wrong because creating separate trails per account does not centralize logs into a single location, and cross-account S3 bucket policies alone do not prevent individual accounts from disabling their own CloudTrail. Option B is wrong because enabling S3 MFA Delete on each account's log bucket only protects against accidental deletion of objects, but does not prevent an account from stopping or deleting the CloudTrail trail itself, nor does it centralize logs. Option C is wrong because CloudWatch Logs aggregation does not provide immutability; logs can be deleted or altered in CloudWatch Logs, and a retention policy of 10 years does not prevent deletion of the log group or stream.

Full explanation →

113

MCQhard

A company is using Amazon GuardDuty to detect threats in its AWS environment. The security team notices that GuardDuty is generating a high number of 'UnauthorizedAccess:IAMUser/MaliciousIPCaller' findings for an IAM user that is used by a legacy application. The security team has verified that the IP addresses flagged are not malicious but are legitimate IPs used by the application's third-party service. The company wants to suppress these findings without disabling GuardDuty entirely. Which solution is the MOST effective and secure?

A.Disable the specific finding type in GuardDuty settings.

B.Create a GuardDuty suppression rule that automatically archives findings for that IAM user.

C.Create a VPC flow log filter to exclude traffic from those IP addresses.

D.Modify the IAM user's permissions to restrict the IP addresses it can use.

AnswerB

Suppression rules allow you to filter out known false positives based on specific criteria.

Why this answer

GuardDuty suppression rules allow you to automatically archive findings that match specific criteria, such as a particular finding type and IAM user ARN. This suppresses false positives for that user without affecting other findings. Option B is correct because it uses this built-in feature.

Option A is incorrect because disabling the finding type would suppress all such findings for all users, which is too broad. Option C is incorrect because VPC flow log filters control logging, not GuardDuty findings. Option D is incorrect because modifying IAM permissions does not influence GuardDuty detection or suppression.

Full explanation →

114

MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to centrally collect and analyze CloudTrail logs from all accounts in a single S3 bucket. What is the most efficient way to achieve this?

A.Create a CloudTrail trail in each account and configure the same S3 bucket as the destination.

B.Use CloudWatch Logs subscription filter to send logs from each account to a central account.

C.Create a single organization trail in the management account that logs all accounts.

D.Use S3 cross-region replication to copy logs from each account's bucket to a central bucket.

AnswerC

Organization trails automatically apply to all accounts in the organization.

Why this answer

AWS Organizations supports creating a single organization trail in the management account that automatically logs CloudTrail events for all accounts in the organization. This centralizes log collection into one S3 bucket without needing to configure trails per account, making it the most efficient and scalable approach for multi-account environments.

Exam trap

The trap here is that candidates often assume each account must have its own trail (Option A) or that a streaming solution like CloudWatch Logs (Option B) is required, overlooking the native organization-level trail feature that simplifies centralization.

How to eliminate wrong answers

Option A is wrong because creating a trail in each account and pointing to the same S3 bucket requires manual setup per account, does not scale efficiently, and can lead to permission conflicts or log overwrites if bucket policies are not correctly configured. Option B is wrong because CloudWatch Logs subscription filters are designed to stream log data to a central account for real-time processing, but they are not the most efficient way to collect CloudTrail logs for long-term storage in S3; they add complexity and cost for a task that organization trails handle natively. Option D is wrong because S3 cross-region replication copies objects between buckets in different regions, but it does not centralize logs from multiple accounts into a single bucket; it requires each account to have its own bucket and replication rules, adding overhead and potential for configuration errors.

Full explanation →

115

MCQmedium

A company wants to allow cross-account access to an S3 bucket in Account A for a user in Account B. What is the correct combination of steps?

A.Add a bucket policy in Account A allowing access to the user in Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.

B.Create an IAM role in Account A with access to the bucket, and have the user in Account B assume that role.

C.Add a bucket policy in Account A allowing access to Account B, and no action is needed in Account B because the user already has permissions.

D.Add a bucket policy in Account A allowing access to Account B, and attach an IAM policy to the user in Account B allowing access to the bucket.

AnswerA

Correct: Both a bucket policy granting access to the specific user and an IAM policy for that user are required for cross-account access.

Why this answer

Cross-account access to an S3 bucket requires two key permissions: a resource-based policy (bucket policy) in the owning account (Account A) that grants access to the specific IAM user in Account B, and an identity-based policy (IAM policy) attached to that user in Account B that permits the necessary S3 actions. Option A correctly describes this combination. Option D grants the bucket policy to the entire Account B, which may work but is less secure and not the recommended least-privilege approach; furthermore, the bucket policy to 'Account B' alone does not grant access to a specific user unless accompanied by the correct IAM policy, but the phrasing is ambiguous and not as precise as Option A.

Option B suggests using an IAM role in Account A, which would require the user to assume the role, a different pattern not matching the question's scenario. Option C is incorrect because the user in Account B must have an explicit IAM policy; the bucket policy alone is insufficient.

Full explanation →

116

Multi-Selecthard

A security engineer is designing a network architecture in AWS. The engineer needs to ensure that all outbound traffic from a VPC goes through a centrally managed NAT device for logging and filtering. The VPC has multiple private subnets. Which TWO steps are required to accomplish this? (Choose TWO.)

Select 2 answers

A.Deploy an HTTP forward proxy in the public subnet.

B.Create a route table for the private subnets with a default route (0.0.0.0/0) pointing to the NAT device.

C.Set up a transit gateway and attach the VPC to it.

D.Create a gateway endpoint for Amazon S3.

E.Place the NAT device in a public subnet with a route to an internet gateway.

AnswersB, E

This routes outbound traffic from private subnets to the NAT device.

Why this answer

To route all outbound traffic from private subnets through a centrally managed NAT device, you need to configure the route tables for those subnets to send default traffic (0.0.0.0/0) to the NAT device (Option B). Additionally, the NAT device must be placed in a public subnet with a route to an internet gateway so it can translate the private IPs and forward traffic to the internet (Option E). Option A is wrong because an HTTP forward proxy is not necessary for this purpose.

Option C is wrong because a transit gateway does not replace the need for a NAT device and route table configuration. Option D is wrong because a gateway endpoint is for private access to services like S3 or DynamoDB, not for general internet traffic.

Full explanation →

117

MCQmedium

A security engineer is investigating a potential security incident. CloudTrail logs show that an IAM user 'admin' deleted an S3 bucket at 2023-01-15T10:30:00Z. The engineer needs to find the source IP address and user agent of the request. Which CloudTrail log field contains this information?

A.eventID

B.requestParameters

C.userAgent and sourceIPAddress

D.resources

AnswerC

These fields contain the required information.

Why this answer

CloudTrail logs capture the `userAgent` and `sourceIPAddress` fields directly in the log event record. These fields are part of the CloudTrail `Event` record structure, specifically under the `userIdentity` and `sourceIPAddress` top-level attributes, and they provide the exact source IP address and user agent string (e.g., AWS CLI, SDK, console browser) for the API call that deleted the S3 bucket.

Exam trap

The trap here is that candidates often confuse `requestParameters` with containing all request metadata, but it only holds the API call's input parameters, not the network-level origin details like source IP or user agent.

How to eliminate wrong answers

Option A is wrong because `eventID` is a unique identifier for the CloudTrail event, used for deduplication and correlation, but it does not contain the source IP or user agent. Option B is wrong because `requestParameters` contains the API request parameters (e.g., bucket name, region) but not the network-level metadata like source IP or user agent. Option D is wrong because `resources` lists the AWS resources involved in the event (e.g., the S3 bucket ARN) but does not include the source IP or user agent.

Full explanation →

118

Multi-Selectmedium

A company is implementing a security monitoring solution for its AWS environment. Which TWO services can be used to detect and alert on suspicious API activity? (Choose TWO.)

Select 2 answers

A.Amazon GuardDuty

B.AWS CloudTrail

C.Amazon Inspector

D.AWS Config

E.VPC Flow Logs

AnswersA, B

GuardDuty analyzes CloudTrail events and other data sources to detect suspicious API activity.

Why this answer

Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized behavior, including suspicious API activity. It analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs to generate security findings and alerts. GuardDuty uses machine learning and anomaly detection to identify patterns such as unusual API calls, credential compromise, or reconnaissance attempts, making it a correct choice for detecting and alerting on suspicious API activity.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API activity) with a service that also detects and alerts on suspicious activity, but CloudTrail itself does not analyze or alert—it only records events; GuardDuty is needed for detection and alerting.

Full explanation →

119

MCQhard

A company uses AWS Transit Gateway to connect multiple VPCs and on-premises networks. The security team wants to inspect all traffic between VPCs using a third-party firewall appliance. Which architecture should be used?

A.Set up AWS Direct Connect and route all traffic through the on-premises firewall.

B.Use Transit Gateway with appliance mode and route tables to direct traffic through a firewall appliance in a central VPC.

C.Create VPC peering connections between each VPC and the firewall VPC.

D.Configure network ACLs in each VPC to block traffic unless it comes from the firewall.

AnswerB

Transit Gateway with appliance mode enables asymmetric routing support, allowing a gateway route table to forward traffic from source VPCs to the central inspection VPC, while the firewall appliance then routes return traffic back through the same appliance, ensuring both directions are inspected. By using separate route tables associated with each VPC attachment, you can force all inter-VPC and outbound traffic through the firewall appliance, which scales horizontally and keeps security inspection centralized.

Why this answer

Transit Gateway with appliance mode enables the firewall appliance in a central VPC to receive traffic from all attached VPCs with symmetric routing, ensuring that both forward and return traffic flows through the same appliance. By configuring route tables to direct inter-VPC traffic to the firewall appliance's elastic network interface (ENI), the security team can inspect all traffic without requiring complex peering or on-premises backhauling.

Exam trap

The trap here is that candidates may assume VPC peering or network ACLs can achieve transitive traffic inspection, but they fail to recognize that only Transit Gateway with appliance mode provides the necessary symmetric routing and transitive routing capabilities for centralized firewall inspection.

How to eliminate wrong answers

Option A is wrong because routing all traffic through an on-premises firewall via AWS Direct Connect introduces unnecessary latency, bandwidth costs, and dependency on the on-premises network, which is not a native AWS architecture for VPC-to-VPC inspection. Option C is wrong because VPC peering does not support transitive routing; each peering connection is a one-to-one relationship, so traffic between two VPCs would not automatically flow through a third-party firewall VPC unless complex routing and additional appliances are manually configured, making it unscalable. Option D is wrong because network ACLs are stateless and operate at the subnet level, not at the traffic inspection layer; they cannot force traffic through a firewall appliance or provide deep packet inspection, and blocking traffic based on source IP alone is insufficient for security policy enforcement.

Full explanation →

120

Multi-Selecthard

A company uses AWS KMS to encrypt objects in an S3 bucket. The security team wants to ensure that only users with the appropriate KMS key permissions can decrypt objects. Which TWO conditions should be included in the S3 bucket policy to enforce this? (Choose TWO.)

Select 2 answers

A."Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}

B."Condition": {"StringEquals": {"kms:KeySpec": "SYMMETRIC_DEFAULT"}}

C."Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}

D."Condition": {"StringEquals": {"kms:GranteePrincipal": "arn:aws:iam::123456789012:role/Admin"}}

E."Condition": {"StringEquals": {"kms:EncryptionContext": {"aws:s3:arn": "arn:aws:s3:::my-bucket"}}}

AnswersA, E

Correct. This condition restricts the KMS key to be used only via the S3 service, ensuring that decryption requests must come through S3.

Why this answer

Options A and E are the only distinct conditions that can be used in an S3 bucket policy to enforce that only users with appropriate KMS key permissions can decrypt objects. kms:ViaService restricts the use of the KMS key to requests coming via the S3 service, and kms:EncryptionContext restricts decryption to requests that include the specific S3 bucket ARN. Option C is identical to A and thus does not provide an additional constraint, making it redundant. Options B and D are not valid condition keys for S3 bucket policies.

Full explanation →

121

MCQhard

A company uses Amazon S3 to store sensitive documents. They must ensure that all objects are encrypted at rest and that any attempt to upload an unencrypted object is denied. Which S3 bucket policy statement achieves this?

A.Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256.

B.Deny s3:PutObject for all principals.

C.Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256 AND the encryption is SSE-S3.

D.Allow s3:PutObject only when x-amz-server-side-encryption: AES256 is present.

AnswerC

Correctly denies unencrypted uploads by requiring the SSE header.

Why this answer

Option C is correct because it explicitly denies PutObject unless the request includes both the x-amz-server-side-encryption header with value AES256 (which requests SSE-S3) and the encryption type is SSE-S3. This ensures only objects encrypted with SSE-S3 can be uploaded. Option A is incorrect because it only checks for the header value AES256; while AES256 is specific to SSE-S3 and would also enforce SSE-S3, Option C provides a more explicit condition.

Option B is incorrect because it denies all PutObject requests. Option D is incorrect because an Allow statement cannot enforce a denial; a Deny statement is required to block unencrypted uploads.

Full explanation →

122

MCQmedium

A security engineer notices that an IAM role has a trust policy allowing any AWS account to assume it. Which attack is this misconfiguration most likely to enable?

A.Logging bypass via CloudTrail

B.Cross-service confused deputy attack

C.Unauthorized access by an external attacker

D.Privilege escalation by attaching additional policies

AnswerC

This is correct: an overly broad trust policy—for example `"Principal": "*"` without restrictive conditions—allows any AWS principal from any account to call `sts:AssumeRole` and obtain the role's temporary security credentials. Once assumed, the attacker receives all permissions attached to the role, enabling unauthorized actions in the account. In the absence of conditions like `aws:PrincipalArn`, `aws:PrincipalAccount`, or an external ID, there is no mechanism to distinguish legitimate principals from external attackers, so the role effectively exposes its permissions to the entire AWS ecosystem.

Why this answer

An IAM role trust policy that allows any AWS account (i.e., `"Principal": {"AWS": "*"}`) to assume the role means that any user or service in any AWS account can call the STS `AssumeRole` API to obtain temporary credentials for the role. This directly enables unauthorized access by an external attacker who can discover the role ARN and assume it, gaining all permissions attached to the role.

Exam trap

The trap here is that candidates may confuse a trust policy misconfiguration with a permissions policy misconfiguration, thinking that privilege escalation (Option D) is the primary risk, when in fact the trust policy directly controls who can assume the role, making unauthorized access the immediate and most likely attack.

How to eliminate wrong answers

Option A is wrong because CloudTrail logs all AWS API calls, including STS `AssumeRole` actions, and there is no mechanism in this misconfiguration to bypass or disable CloudTrail logging. Option B is wrong because a cross-service confused deputy attack involves a malicious service tricking another service into using its own permissions, not an overly permissive trust policy allowing any AWS account to assume a role. Option D is wrong because the misconfiguration is in the trust policy, not in the permissions policy; privilege escalation by attaching additional policies would require the attacker to already have IAM permissions to modify policies, which is not enabled by the trust policy alone.

Full explanation →

123

MCQeasy

A company needs to audit all changes to IAM policies in their AWS account. Which AWS service should they use to record these changes?

A.Amazon S3

B.Amazon CloudWatch Logs

C.AWS Config

D.AWS CloudTrail

AnswerD

CloudTrail logs all API calls, including IAM policy modifications.

Why this answer

AWS CloudTrail records API calls, including IAM policy changes. Option D is correct because CloudTrail logs all IAM policy modifications. Option A (Amazon S3) is wrong because S3 is a storage service and does not record API calls.

Option B (Amazon CloudWatch Logs) is wrong because CloudWatch Logs stores logs but does not directly record API calls for audit purposes. Option C (AWS Config) is wrong because AWS Config records resource state changes but not the API calls that caused those changes.

Full explanation →

124

MCQhard

A company uses AWS Organizations with a management account and several member accounts. The security team wants to restrict the use of specific AWS services (e.g., EC2, Lambda) in certain accounts based on the account's environment (dev, test, prod). Which approach should be used to implement this requirement?

A.Use AWS CloudTrail to monitor API calls and revoke access after the fact.

B.Create IAM roles in each account with policies that deny access to services.

C.Use AWS Organizations to tag accounts (e.g., Environment=Dev) and use SCPs with conditions to deny access to services based on tags.

D.Use AWS Config rules to detect and alert when restricted services are used.

AnswerC

Tag-based SCPs allow fine-grained control across accounts.

Why this answer

By tagging accounts in AWS Organizations (e.g., Environment=Dev) and using Service Control Policies (SCPs) with conditions based on those tags, the security team can restrict usage of specific AWS services per account environment. SCPs are applied at the organization level and affect all users and roles in the account, providing preventive controls. Option A is incorrect because CloudTrail only logs API calls and does not prevent usage; revoking access after the fact is not a preventive measure.

Option B is incorrect because IAM roles are identity-based and do not restrict services at the account level; also, managing roles per account would be cumbersome. Option D is incorrect because AWS Config rules detect non-compliant resource configurations but do not prevent the use of services; they are detective controls.

Full explanation →

125

MCQeasy

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. Which AWS service can evaluate security group rules against a desired configuration and alert on changes?

A.AWS Security Hub

B.AWS Config

C.Amazon GuardDuty

D.AWS CloudTrail

AnswerB

AWS Config is the correct choice because it continuously records configuration changes to your security groups, including additions or deletions of ingress and egress rules. By using managed or custom Config rules, you can define a desired security group configuration (for example, disallowing SSH access from 0.0.0.0/0) and AWS Config will evaluate each change against that baseline, generating compliance alerts and invoking remediation via EventBridge or Lambda when a noncompliant change occurs.

Why this answer

AWS Config is correct because it provides a managed rule called 'restricted-ssh' or custom rules using AWS Config managed rules or Lambda functions to evaluate security group rules against a desired configuration. When a security group rule is added, removed, or modified, AWS Config detects the configuration change, evaluates it against the defined rules, and can trigger an Amazon SNS notification to alert the security engineer. This makes AWS Config the appropriate service for continuous monitoring and alerting on unauthorized changes to security group rules.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with AWS Config (which evaluates the resulting configuration state), leading them to choose CloudTrail because they think logging API calls is sufficient for monitoring unauthorized changes, but CloudTrail does not evaluate the configuration against a desired state or provide alerting on noncompliant rules.

How to eliminate wrong answers

Option A is wrong because AWS Security Hub aggregates security findings from multiple services (like AWS Config, GuardDuty, and Inspector) and provides a comprehensive security posture view, but it does not directly evaluate security group rules against a desired configuration or generate alerts for unauthorized changes on its own. Option C is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious activity, not for monitoring configuration changes to security group rules. Option D is wrong because AWS CloudTrail records API calls (including those that modify security groups) for auditing and forensic analysis, but it does not evaluate the resulting configuration against a desired state or provide alerting on unauthorized changes—it only logs the actions taken.

Full explanation →

126

MCQmedium

A security engineer is investigating a potential data exfiltration incident. The engineer notices that an EC2 instance with an attached IAM role has been making API calls to an S3 bucket in another AWS account. The engineer wants to identify the source of the API calls and determine if the calls are malicious. Which AWS service should the engineer use to view the API calls made by the IAM role?

A.VPC Flow Logs

B.Amazon GuardDuty

C.AWS Config

D.AWS CloudTrail

AnswerD

CloudTrail records API calls made by IAM roles and provides details such as source IP, user agent, and request parameters.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made by IAM roles, including the source IP address, user agent, and the specific actions performed. In this scenario, CloudTrail logs will show the exact API calls made by the EC2 instance's IAM role to the S3 bucket in another account, enabling the security engineer to identify the source and determine if the calls are malicious.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (which show network traffic) with CloudTrail (which shows API calls), or they assume GuardDuty provides raw logs instead of just alerts, leading them to pick a service that cannot directly answer the question of viewing the specific API calls made by the IAM role.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) but do not log AWS API calls or IAM role activity. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes CloudTrail, VPC Flow Logs, and DNS logs for anomalies, but it does not directly provide the raw API call logs needed to view the specific actions taken by the IAM role. Option C is wrong because AWS Config records resource configuration changes and compliance, not the API calls made by IAM roles.

Full explanation →

127

MCQhard

Refer to the exhibit. A developer receives an 'UnauthorizedOperation' error when launching an EC2 instance with the specified security group. The developer has permissions to use ec2:RunInstances. What is the most likely cause?

A.The security group contains an inbound rule with a source of 0.0.0.0/0 for port 80, which is too permissive and triggers a service control policy (SCP) that denies launching instances with overly permissive rules.

B.The security group allows inbound HTTPS from the entire RFC 1918 address space, but the instance is in a public subnet.

C.The security group allows outbound all traffic, which violates the principle of least privilege.

D.The instance type t2.micro is not available in the specified subnet's Availability Zone.

AnswerA

Incorrect. SCPs cannot deny actions based on the content of security group rules (e.g., permissiveness). They can only deny based on resource identifiers like security group IDs.

Why this answer

The 'UnauthorizedOperation' error is an authorization error that occurs when a service control policy (SCP) explicitly denies the ec2:RunInstances action. In this scenario, the SCP is configured to deny launching instances associated with security groups that have overly permissive rules, such as an inbound rule from 0.0.0.0/0. Although SCPs cannot dynamically inspect security group rule content, administrators can implement deny policies targeting specific security groups known to be permissive.

The developer's IAM policy allows RunInstances, but the SCP overrides that permission. Option D is incorrect because an instance type not being available in an Availability Zone results in a capacity or compatibility error (e.g., 'InsufficientInstanceCapacity'), not an 'UnauthorizedOperation' error.

Exam trap

Candidates often assume 'UnauthorizedOperation' always indicates missing IAM permissions, but SCPs can cause this error even when the user has explicit Allow, due to an explicit deny on specific resources or conditions.

How to eliminate wrong answers

Option B is wrong because allowing inbound HTTPS from RFC 1918 address space (private IPs) is not inherently problematic and would not trigger an 'UnauthorizedOperation' error; the error is about authorization, not subnet placement. Option C is wrong because outbound all traffic is a default security group setting and does not violate the principle of least privilege in a way that would cause an 'UnauthorizedOperation' error; SCPs typically focus on inbound rules for overly permissive access. Option D is wrong because t2.micro is a standard instance type available in most Availability Zones; if it were unavailable, the error would be 'InsufficientInstanceCapacity' or 'InvalidParameterValue', not 'UnauthorizedOperation'.

Full explanation →

128

MCQhard

A company runs a web application on an Auto Scaling group of EC2 instances behind an Application Load Balancer. The application stores user session data in an ElastiCache Redis cluster. The security team receives an alert from GuardDuty that one of the EC2 instances is communicating with a known command-and-control (C2) IP address. The instance ID is i-0a1b2c3d4e5f. The security engineer needs to contain the threat immediately while preserving the instance for forensic analysis. Which course of action should the security engineer take?

A.Apply a new security group that denies all inbound and outbound traffic to the instance.

B.Remove the security group from the Auto Scaling group to isolate the instance.

C.Terminate the EC2 instance immediately to stop the communication.

D.Create an AMI of the instance for forensic analysis and then terminate the instance.

AnswerA

Applying a new security group that denies all inbound and outbound traffic immediately severs the instance's network path at the hypervisor, cutting off the C2 server connection without killing the process or losing memory artifacts. Because security group changes are applied instantly across the VPC, this containment step is faster than OS-level firewall rules and avoids tipping off the attacker. The instance remains powered on, allowing you to capture a memory dump and disk image for forensic analysis before any restoration or termination.

Why this answer

Applying a new security group that denies all inbound and outbound traffic immediately stops the C2 communication at the network layer without destroying the instance. This preserves the instance for forensic analysis (e.g., memory dump, disk imaging) while containing the threat. The security group acts as a virtual firewall, and changing it is a non-destructive, reversible action that can be applied directly to the instance even if it is part of an Auto Scaling group.

Exam trap

The trap here is that candidates often choose to terminate the instance (Option C) thinking it is the fastest containment, but they overlook the critical requirement to preserve the instance for forensic analysis, which termination destroys.

How to eliminate wrong answers

Option B is wrong because removing the security group from the Auto Scaling group does not isolate the instance; the instance retains its existing security group(s) and continues to communicate. Option C is wrong because terminating the instance destroys the forensic evidence (e.g., volatile memory, running processes, disk state) and prevents further analysis. Option D is wrong because creating an AMI takes time and does not immediately stop the C2 communication; the instance remains active and can continue exfiltrating data or receiving commands during the AMI creation process.

Full explanation →

129

MCQhard

A security engineer is configuring AWS CloudWatch Logs to monitor for suspicious activity. They want to create a metric filter that detects when an IAM user calls the `iam:CreateAccessKey` API. The engineer writes the following filter pattern: `{ ($.eventName = "CreateAccessKey") }`. After testing, the filter does not trigger. What is the most likely reason?

A.The filter pattern syntax is incorrect; it should use square brackets.

B.The metric filter is not associated with the correct log group.

C.CloudWatch Logs does not support metric filters for CloudTrail logs.

D.The filter pattern does not include the eventSource field, so it might match events from other services.

AnswerB

The most likely cause is that the metric filter is attached to a different log group than the one receiving the CloudTrail CreateAccessKey events. Metric filters evaluate only log data that arrives in the specific log group they are configured on; if the CloudTrail trail streams to another log group in another account or region, or the filter is created under the wrong log group name, the pattern never sees the relevant events. Verify the trail's destination log group and that the filter is assigned there.

Why this answer

The filter pattern `{ ($.eventName = "CreateAccessKey") }` is syntactically correct and will match any CloudTrail event with eventName CreateAccessKey, regardless of service. The most likely reason the filter does not trigger is that the metric filter is not associated with the correct log group, or the log group does not contain CloudTrail events from IAM. A missing eventSource field does not prevent the filter from working; it would simply match events from any service, which could cause false positives, but not a failure to trigger.

Exam trap

Candidates often focus on filter pattern syntax or missing fields when the filter doesn't trigger, but the most common cause is misconfiguration of the metric filter's association to the log group. Always verify the log group contains the expected CloudTrail events and that the metric filter is correctly linked.

How to eliminate wrong answers

Option A is wrong because the filter pattern syntax `{ ($.eventName = "CreateAccessKey") }` is correct for CloudWatch Logs metric filters; square brackets are not used in metric filter patterns (they are used in CloudWatch Logs Insights queries). Option B is wrong because the question states the filter does not trigger after testing, implying it was associated with a log group, and the issue is with the pattern itself, not the association. Option C is wrong because CloudWatch Logs fully supports metric filters for CloudTrail logs, which is a common use case for monitoring API activity.

Full explanation →

130

MCQmedium

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The instance is part of an Auto Scaling group behind an Application Load Balancer. The engineer needs to immediately stop the exfiltration while preserving forensic evidence. What is the BEST course of action?

A.Detach the EBS volume from the instance.

B.Terminate the EC2 instance immediately.

C.Shut down the instance from within the OS.

D.Remove the instance from the target group and apply a security group that denies all traffic.

AnswerD

Stops traffic and preserves the instance for investigation.

Why this answer

Removing the instance from the target group immediately stops new traffic from the Application Load Balancer to the instance, while applying a security group that denies all outbound traffic (e.g., a custom security group with no outbound rules) halts any ongoing exfiltration without destroying the instance or its attached EBS volumes. This preserves the forensic evidence (memory, disk, logs) for later analysis, unlike termination or shutdown which could lose volatile data.

Exam trap

The trap here is that candidates often choose 'Terminate the EC2 instance immediately' (Option B) thinking it stops the exfiltration fastest, but they overlook the need to preserve forensic evidence and the fact that termination destroys the instance and its associated data, making post-incident analysis impossible.

How to eliminate wrong answers

Option A is wrong because detaching the EBS volume does not stop the instance from sending outbound traffic over the network; the instance continues running and can still exfiltrate data via network interfaces. Option B is wrong because terminating the instance immediately destroys the instance, its attached EBS volumes (unless termination protection is enabled and the 'Delete on Termination' flag is set to false), and any volatile forensic evidence (e.g., memory contents, running processes). Option C is wrong because shutting down the instance from within the OS (e.g., via 'shutdown -h now') stops the instance but does not guarantee that the OS will complete the shutdown cleanly; more importantly, it does not isolate the instance from the network first, allowing continued exfiltration during the shutdown process, and it may trigger Auto Scaling to launch a replacement instance before forensic capture.

Full explanation →

131

MCQmedium

During an incident response, a security engineer needs to preserve the state of an EC2 instance's root volume for forensic analysis. The instance is still running. Which action should be taken to ensure the data is preserved without altering it?

A.Stop the instance and then create an AMI.

B.Create a snapshot of the root volume.

C.Use dd if=/dev/xvda over SSH to copy the volume.

D.Detach the root volume and attach it to a forensics instance.

AnswerB

A snapshot is a point-in-time, crash-consistent copy of the EBS root volume that preserves the current on-disk state without stopping or detaching the instance. Taking a snapshot is the standard forensic first step because it is non-intrusive, does not trigger shutdown scripts, and keeps the original volume intact for later analysis while the snapshot can be inspected on a separate examination instance.

Why this answer

Creating a snapshot of the root volume is the correct action because it captures a point-in-time, crash-consistent copy of the volume's data without requiring the instance to be stopped or the volume to be detached. This preserves the current state of the running instance for forensic analysis while ensuring the data is not altered by the snapshot process itself, as AWS snapshots are read-only and do not modify the source volume.

Exam trap

The trap here is that candidates may think stopping the instance (Option A) is necessary to ensure data consistency, but they overlook that stopping alters the system state and that a snapshot of a running instance is still a valid, unaltered point-in-time copy for forensic purposes.

How to eliminate wrong answers

Option A is wrong because stopping the instance changes its state (e.g., flushes memory, stops processes) and may alter or lose volatile data that is critical for forensic analysis; creating an AMI from a stopped instance also introduces additional metadata and is not a direct, unaltered copy of the root volume. Option C is wrong because using dd over SSH to copy the root device (/dev/xvda) while the instance is running will result in an inconsistent copy due to ongoing writes, and it modifies the source volume by reading it, potentially triggering forensic concerns about data integrity and chain of custody. Option D is wrong because detaching the root volume from a running instance forces an immediate stop of the instance (since the root volume is required for operation), which alters the system state and may cause data loss or corruption; attaching it to a forensics instance then introduces the risk of write operations to the volume.

Full explanation →

132

Multi-Selectmedium

A Security Engineer is configuring a VPC with a public subnet for a web server and a private subnet for a database. The web server needs to download patches from the internet. Which TWO actions should the Engineer take to allow the web server internet access without exposing the database to the internet?

Select 2 answers

A.Create a bastion host in the public subnet and configure the web server to use it as a proxy.

B.Create a VPC endpoint for Amazon S3.

C.Create a NAT Gateway in the public subnet.

D.Attach an Internet Gateway to the VPC and add a route to the Internet Gateway in the private subnet's route table.

E.Add a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway.

AnswersC, E

NAT Gateway enables outbound internet access for instances in private subnets.

Why this answer

A NAT Gateway in the public subnet allows instances in the private subnet to initiate outbound IPv4 traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections from the internet. By adding a route in the private subnet's route table that points 0.0.0.0/0 to the NAT Gateway, the web server's outbound traffic is forwarded to the NAT Gateway, which then uses the Internet Gateway to reach the internet. The database remains isolated because it has no direct route to the Internet Gateway and no public IP address.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with a bastion host or assume that a VPC endpoint for S3 can provide general internet access, but the key distinction is that a NAT Gateway enables outbound internet connectivity for private subnets without exposing them to inbound traffic.

Full explanation →

133

MCQhard

A company uses AWS CloudTrail to log all API calls. During an incident investigation, the security team needs to identify who deleted an S3 bucket. CloudTrail logs are stored in a centralized S3 bucket with server-side encryption using AWS KMS. Which additional step is required to ensure the CloudTrail logs can be queried quickly for this investigation?

A.Enable CloudTrail Lake

B.Stream logs to CloudWatch Logs and use CloudWatch Logs Insights

C.Use Amazon Athena with a table defined over the S3 bucket

D.Enable Amazon GuardDuty

AnswerC

Amazon Athena can query CloudTrail logs stored in S3 by defining a table over the bucket using the CloudTrail SerDe, with columns matching the JSON event structure and partitions for date/hour. The table is either created manually via a DDL statement or automatically by the 'Create Athena table' option in the CloudTrail console. Athena then runs standard SQL directly on the compressed log objects without moving or transforming the data, making it the simplest serverless way to search all API calls.

Why this answer

Amazon Athena allows you to query CloudTrail logs directly in S3 using standard SQL without needing to move or transform the data. Since the logs are already in a centralized S3 bucket, defining a table over that location enables fast, ad-hoc queries to identify the specific DeleteBucket event, including who performed it and when. This approach is cost-effective and avoids additional streaming or storage costs.

Exam trap

The trap here is that candidates often assume CloudTrail logs must be streamed to CloudWatch Logs for querying, but Athena provides a more direct and cost-effective solution for querying historical logs stored in S3 without additional streaming overhead.

How to eliminate wrong answers

Option A is wrong because CloudTrail Lake is a managed data lake for CloudTrail logs that requires ingesting logs into a separate event data store, which adds cost and complexity; it is not necessary for querying existing logs in S3. Option B is wrong because streaming logs to CloudWatch Logs incurs additional costs and latency, and CloudWatch Logs Insights is designed for real-time monitoring of operational metrics, not for deep forensic analysis of historical S3 bucket deletions. Option D is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC flow logs, DNS logs, and CloudTrail management events for anomalies, but it does not provide a direct query interface to search for specific historical events like who deleted an S3 bucket.

Full explanation →

134

MCQeasy

A developer needs to grant an EC2 instance read-only access to an S3 bucket. Which of the following is the most secure way to provide these permissions?

A.Use an IAM role and store the credentials in AWS Systems Manager Parameter Store, then retrieve them at instance launch.

B.Create an IAM role with read-only access and attach it to the EC2 instance profile.

C.Create a bucket policy that grants read-only access to the instance's public IP address.

D.Create an IAM user with read-only access and store the access keys in the instance's user data.

AnswerB

IAM roles for EC2 provide temporary credentials without managing keys.

Why this answer

Using an IAM role attached to an instance profile grants temporary credentials and eliminates long-term access keys. Option A is incorrect because storing credentials in Parameter Store (or any static storage) is less secure than using an instance profile, and IAM roles do not have static credentials to store. Option C is incorrect because a bucket policy cannot grant access based on an instance's public IP in a secure or reliable way, and it would grant access to anyone with that IP, not just the instance.

Option D is incorrect because storing IAM user access keys in user data exposes long-term credentials, which is less secure than using an instance profile.

Full explanation →

135

MCQeasy

Which IAM entity can be used to delegate permissions to an AWS service to perform actions on your behalf?

A.Service role

B.Service-linked role

C.Instance profile

D.Permissions boundary

AnswerA

A service role allows an AWS service to assume it and perform actions.

Why this answer

A service role is an IAM role that a service assumes to perform actions on your behalf. Option A is correct. Option B is wrong because a service-linked role is a special type of service role, but not all service roles are service-linked.

Option C is wrong because an instance profile is used for EC2. Option D is wrong because a permissions boundary is used to set maximum permissions.

Full explanation →

136

MCQhard

Refer to the exhibit. An IAM policy allows running EC2 instances. A developer tries to launch a t2.micro instance but receives an 'AccessDenied' error. What is the most likely reason?

A.The policy does not grant permissions for other required resources such as images or security groups.

B.The developer is trying to launch a different instance type.

C.The region in the policy does not match the developer's region.

D.The policy has an explicit deny elsewhere.

AnswerA

RunInstances requires permissions on multiple resource types; the policy only grants on instance, not on image, network, etc.

Why this answer

Even though the policy allows the ec2:RunInstances action on the instance resource, the RunInstances API call requires permissions for other resources such as Amazon Machine Images (AMI), security groups, and key pairs. Without explicit permissions for these resources, the API call fails with an AccessDenied error. Option B is incorrect because the condition specifies t2.micro, matching the developer's request.

Option C is incorrect because the policy does not restrict by region. Option D is incorrect because there is no explicit deny; the denial is due to missing resource permissions.

Full explanation →

137

MCQhard

A company uses AWS KMS to encrypt data in Amazon S3. The security team notices that a KMS key has been deleted accidentally, causing data loss. The company wants to implement a solution to prevent accidental key deletion and enable recovery. What should the security team do?

A.Enable the key's 'Disable key' option and set a deletion waiting period of 7 days.

B.Enable automatic key rotation for the KMS key.

C.Create a multi-Region key and enable automatic key rotation.

D.Use AWS CloudHSM to store the key material and create a backup in another Region.

AnswerC

Multi-Region keys provide a replica in another region for recovery, and automatic rotation improves security.

Why this answer

Creating a multi-Region key replicates the key material to another AWS Region, providing a backup that can be used if the primary key is accidentally deleted. Enabling automatic key rotation further enhances security by regularly rotating the backing keys, but it does not prevent deletion. However, the multi-Region key approach allows recovery from accidental deletion by using the replica in another Region.

Option A is incorrect because disabling the key only prevents its use, not its deletion; the deletion waiting period allows recovery only if the deletion is canceled within the waiting period. Option B is incorrect because automatic key rotation does not prevent deletion; it only creates new cryptographic material. Option D is incorrect because AWS CloudHSM does not directly integrate with S3 server-side encryption using KMS (SSE-KMS) for automatic encryption; it requires custom applications.

Exam trap

Candidates may think that enabling automatic key rotation prevents deletion, but it only rotates the key material. The actual prevention of deletion and recovery is achieved through multi-Region keys, which provide a replica in another Region.

Full explanation →

138

MCQmedium

A company uses Amazon GuardDuty for threat detection. The security team wants to automatically isolate an EC2 instance that is communicating with a known malicious IP address. Which combination of services should be used?

A.GuardDuty -> AWS Config -> Lambda -> modify security group

B.GuardDuty -> CloudWatch Alarm -> Lambda -> modify security group

C.GuardDuty -> EventBridge -> Lambda -> modify security group

D.GuardDuty -> AWS Shield -> modify security group

E.GuardDuty -> AWS Systems Manager -> modify security group

AnswerC

EventBridge can receive GuardDuty findings and trigger Lambda.

Why this answer

Amazon GuardDuty generates findings that can be sent to Amazon EventBridge as events. EventBridge can then trigger an AWS Lambda function that modifies the security group associated with the EC2 instance to deny traffic to/from the malicious IP address. This architecture provides a serverless, event-driven response mechanism without polling or additional services.

Exam trap

The trap here is that candidates confuse CloudWatch Alarms with EventBridge, not realizing that GuardDuty findings are event-driven and require a rule-based event bus (EventBridge) rather than a metric-based alarm (CloudWatch Alarm) to trigger remediation.

How to eliminate wrong answers

Option A is wrong because AWS Config is a configuration compliance and resource inventory service, not an event-driven trigger for real-time threat response; it cannot directly forward GuardDuty findings to Lambda. Option B is wrong because CloudWatch Alarms are designed for metric-based thresholds (e.g., CPU utilization), not for receiving structured JSON findings from GuardDuty; GuardDuty does not natively publish to CloudWatch Alarms. Option D is wrong because AWS Shield is a DDoS protection service and does not process GuardDuty findings or modify security groups.

Option E is wrong because AWS Systems Manager is an operations management service for patching and automation, not designed to consume GuardDuty findings in real time for security group modifications.

Full explanation →

139

MCQeasy

A company wants to allow an external auditor to read all objects in a specific S3 bucket for a limited time. What is the most secure way to grant this access?

A.Generate pre-signed URLs for the objects the auditor needs to read, with an expiration time.

B.Use a bucket policy that allows access only from the auditor's IP address.

C.Make the bucket public and restrict access via IP address in the bucket policy.

D.Create an IAM user for the auditor with read-only access to the bucket and share the access keys.

AnswerA

Pre-signed URLs provide time-limited access without sharing credentials.

Why this answer

Pre-signed URLs provide temporary, granular access to specific S3 objects without requiring the auditor to have AWS credentials. The expiration time ensures access is limited. Option B is incorrect because a bucket policy restricting by IP address still requires the auditor to have some form of authentication (like IAM user credentials) to access the bucket, and it doesn't provide object-level granularity.

Option C is incorrect because making the bucket public, even with IP restrictions, is less secure as it could allow unintended access from allowed IPs and doesn't provide temporary access. Option D is incorrect because creating an IAM user for an external auditor and sharing access keys is a security risk; the credentials could be compromised or misused, and it's not a best practice for temporary external access.

Full explanation →

140

MCQeasy

A security engineer notices that an IAM role used by an EC2 instance is generating a large number of API calls to an S3 bucket that is not part of the company's account. Which AWS service should be used to detect and alert on this suspicious activity?

A.AWS CloudTrail

B.Amazon Inspector

C.AWS Config

D.Amazon GuardDuty

AnswerD

GuardDuty uses machine learning to detect unusual API activity across accounts.

Why this answer

Amazon GuardDuty is the correct service because it uses machine learning and anomaly detection to analyze AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs. It can detect unusual API calls, such as an EC2 instance role making a high volume of requests to an S3 bucket outside the company's account, which is a classic indicator of compromised credentials or data exfiltration. GuardDuty generates findings and can integrate with Amazon CloudWatch Events to trigger alerts or automated remediation.

Exam trap

The trap here is that candidates often confuse CloudTrail (which logs the activity) with GuardDuty (which analyzes and alerts on the activity), leading them to select CloudTrail because they think logging alone is sufficient for detection, but GuardDuty is the service specifically designed for threat detection and alerting.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail is a logging service that records API calls, but it does not perform real-time detection, analysis, or alerting on suspicious activity; it only provides raw logs that require separate monitoring and analysis. Option B is wrong because Amazon Inspector is a vulnerability management service that assesses EC2 instances for software vulnerabilities and unintended network exposure, not for detecting anomalous API call patterns or cross-account data access. Option C is wrong because AWS Config is a resource inventory and compliance service that evaluates resource configurations against rules, but it does not analyze API call patterns or detect anomalous behavior like unusual S3 access from an IAM role.

Full explanation →

141

MCQeasy

A company wants to detect and alert on changes to IAM roles and policies in their AWS account. Which combination of AWS services should they use?

A.Amazon GuardDuty and AWS Shield

B.Amazon CloudWatch Logs and AWS Lambda

C.AWS CloudTrail and Amazon EventBridge (CloudWatch Events)

D.AWS Config and Amazon Inspector

AnswerC

AWS CloudTrail is the correct service to record all IAM API activity—such as CreateRole, UpdateAssumeRolePolicy, AttachRolePolicy, and DeleteRole—by generating event logs with details like the requesting principal, source IP, and timestamp. Amazon EventBridge (formerly CloudWatch Events) can be configured with rule patterns that match specific IAM events, then trigger actions like sending notifications to Amazon SNS or invoking a Lambda function. This combination enables near-real-time, event-driven alerting on exactly the IAM role changes that the company cares about, with no need for polling or custom log parsing.

Why this answer

AWS CloudTrail records all API calls, including changes to IAM roles and policies, and delivers log files to an S3 bucket or CloudWatch Logs. Amazon EventBridge (formerly CloudWatch Events) can then be used to create rules that match specific CloudTrail events (e.g., PutRolePolicy, CreateRole) and trigger alerts via SNS, Lambda, or other targets. This combination provides real-time detection and notification of IAM modifications.

Exam trap

The trap here is that candidates often confuse AWS Config (which evaluates resource compliance) with real-time event-driven alerting, or they mistakenly think GuardDuty’s threat detection includes IAM policy change alerts, when in fact CloudTrail + EventBridge is the correct pattern for custom event-based monitoring.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that monitors for malicious activity using VPC Flow Logs, DNS logs, and CloudTrail events, but it does not directly alert on IAM policy changes; AWS Shield is a DDoS protection service and irrelevant here. Option B is wrong because CloudWatch Logs can store log data but cannot independently detect or alert on IAM changes without a rule engine like EventBridge; Lambda alone cannot trigger on CloudTrail events without an event source such as EventBridge or S3 notifications. Option D is wrong because AWS Config evaluates resource compliance against rules and can detect drift in IAM policies, but it does not provide real-time event-driven alerts; Amazon Inspector is a vulnerability assessment service for EC2 instances and container workloads, not for IAM change detection.

Full explanation →

142

Multi-Selectmedium

Which TWO of the following are valid ways to grant an IAM user permissions to access an S3 bucket? (Choose 2.)

Select 2 answers

A.Assign an instance profile to the user.

B.Create a VPC endpoint policy.

C.Attach an IAM policy to the user.

D.Add the user to an IAM group with a policy.

E.Use an SCP to allow access.

AnswersC, D

IAM policies attached to users grant permissions.

Why this answer

An IAM policy attached directly to a user explicitly grants that user permissions to perform specific actions on an S3 bucket. This is a fundamental method of identity-based access control in AWS, where the policy document defines allowed or denied actions (e.g., s3:GetObject) and resources (e.g., arn:aws:s3:::example-bucket/*).

Exam trap

The trap here is that candidates often confuse identity-based policies (attached to users/groups/roles) with resource-based policies (like bucket policies) or other access control mechanisms (like SCPs or VPC endpoint policies), leading them to select options that do not directly grant permissions to an IAM user.

Full explanation →

143

MCQmedium

Refer to the exhibit. A security engineer created this S3 bucket policy to allow CloudTrail to deliver logs. However, log delivery is failing. What is the most likely cause?

A.The bucket is not in the same region as the trail

B.The bucket policy does not specify a condition

C.The bucket is encrypted with SSE-KMS

D.The bucket policy does not allow s3:GetBucketAcl

AnswerD

CloudTrail needs GetBucketAcl to verify bucket ownership.

Why this answer

CloudTrail requires the S3 bucket policy to grant the `s3:GetBucketAcl` permission to the CloudTrail service principal (`cloudtrail.amazonaws.com`) so that it can verify the bucket's ACL before delivering logs. Without this permission, CloudTrail cannot confirm it has write access, causing log delivery to fail. The missing `s3:GetBucketAcl` action is the most likely cause because the policy must explicitly allow both `s3:PutObject` and `s3:GetBucketAcl` for the service to function.

Exam trap

The trap here is that candidates often focus on encryption (SSE-KMS) or region mismatches as common failure points, but AWS specifically tests the requirement for `s3:GetBucketAcl` in CloudTrail bucket policies, which is a less intuitive but mandatory permission for the service to validate access.

How to eliminate wrong answers

Option A is wrong because CloudTrail can deliver logs to a bucket in a different region as long as the bucket policy allows cross-region access and the trail is configured accordingly; region mismatch does not inherently cause failure. Option B is wrong because conditions are optional in S3 bucket policies for CloudTrail; the policy can work without a condition block if the principal and actions are correctly specified. Option C is wrong because SSE-KMS encryption is supported by CloudTrail, provided the bucket policy includes the necessary `kms:Decrypt` and `kms:GenerateDataKey` permissions for the CloudTrail principal; encryption alone does not block log delivery.

Full explanation →

144

MCQeasy

A company wants to restrict access to an Amazon S3 bucket so that only users from a specific AWS account can upload objects. Which policy mechanism should be used?

A.Create a bucket policy with a condition that checks the aws:SourceAccount condition key.

B.Attach an IAM policy to the bucket that denies access to all users except those from the allowed account.

C.Generate a pre-signed URL for each upload request.

D.Configure the bucket ACL to grant access only to the allowed account's canonical user ID.

AnswerA

A bucket policy with an aws:SourceAccount condition key evaluates the account ID of the IAM principal that signs the request and is enforced by S3 when the bucket is accessed. This condition is evaluated against the requester's account number, allowing you to allow or deny access based on that account without specifying individual user ARNs. It is the recommended approach because it uses a resource-based policy that directly supports condition keys, and it ensures all requests from unintended accounts are rejected.

Why this answer

A bucket policy with the `aws:SourceAccount` condition key allows you to restrict access to a specific AWS account. When users from the allowed account upload objects, the condition evaluates the source account ID, ensuring only requests originating from that account are permitted. This is the recommended approach for cross-account access control in S3, as it directly enforces the account-level restriction at the bucket policy level.

Exam trap

The trap here is that candidates confuse IAM policies with resource-based policies, thinking an IAM policy can be attached to an S3 bucket, or they mistakenly believe bucket ACLs or pre-signed URLs can enforce account-level restrictions.

How to eliminate wrong answers

Option B is wrong because IAM policies are attached to IAM users, groups, or roles, not directly to S3 buckets; you cannot attach an IAM policy to a bucket. Option C is wrong because pre-signed URLs grant temporary access to specific objects for any user with the URL, regardless of AWS account, and do not restrict uploads to a specific account. Option D is wrong because bucket ACLs are legacy and do not support account-level restrictions based on AWS account IDs; they use canonical user IDs, which are not the same as AWS account IDs and are less flexible for cross-account control.

Full explanation →

145

MCQmedium

A security engineer needs to protect data in transit between an EC2 instance and an RDS database. The RDS database uses SSL/TLS certificates. What is the MOST secure way to ensure that the connection is encrypted?

A.Configure the EC2 instance to use a self-signed certificate for SSL connections.

B.Enable encryption at rest on the RDS instance to automatically encrypt in-transit traffic.

C.Download the RDS CA certificate to the EC2 instance and configure the database client to use SSL and verify the certificate.

D.Create an IAM policy that requires SSL connections to the RDS endpoint.

AnswerC

This provides strong encryption and server identity verification.

Why this answer

Downloading the RDS CA certificate to the EC2 instance and configuring the database client to use SSL with certificate verification ensures that the data in transit is encrypted and that the server's identity is verified, preventing man-in-the-middle attacks. Option A is incorrect because a self-signed certificate without proper verification does not provide a trusted chain of identity. Option B is incorrect because encryption at rest protects data stored on disk, not data in transit.

Option D is incorrect because IAM policies can require SSL but cannot enforce the actual encryption of the connection; the client must still be configured to use SSL.

Full explanation →

146

MCQmedium

A security engineer sees the above security group configuration for an EC2 instance. The instance hosts a web application that should only be accessible from the internal network (10.0.0.0/8) over HTTPS, and SSH should not be open to the internet. What is the security issue with this configuration?

A.The outbound rule allows all traffic to all destinations.

B.The inbound HTTPS rule is too permissive.

C.The inbound SSH rule is too permissive.

D.There is no security issue; the configuration is correct.

AnswerA

The outbound rule is defined as allowing all traffic to 0.0.0.0/0, meaning any instance associated with this security group can initiate connections to any IP address on any port. This violates the principle of least privilege because if an attacker compromises the instance, they could use it as a pivot to exfiltrate sensitive data or launch outbound attacks. Even though inbound HTTPS may also be overly broad, the outbound any-any rule is a critical misconfiguration because it provides no egress filtering or restrictions to required services.

Why this answer

The outbound rule allowing all traffic to all destinations (0.0.0.0/0) violates the principle of least privilege. While the inbound rules restrict HTTPS to the internal network (10.0.0.0/8) and SSH is not open to the internet, the outbound rule permits any instance in the security group to initiate connections to any IP address and port, including malicious external hosts. This could allow data exfiltration or outbound attacks, which is a security issue even if inbound access is properly restricted.

Exam trap

The trap here is that candidates focus solely on inbound rules (HTTPS and SSH) and overlook the outbound rule, assuming that stateful security groups automatically handle outbound traffic safely, but AWS explicitly tests that outbound rules must also be restricted to follow least privilege.

How to eliminate wrong answers

Option B is wrong because the inbound HTTPS rule is correctly scoped to the internal network (10.0.0.0/8), which aligns with the requirement that the web application should only be accessible from the internal network. Option C is wrong because the inbound SSH rule is not open to the internet (0.0.0.0/0) in the provided configuration; it is restricted to the internal network (10.0.0.0/8), so it is not too permissive. Option D is wrong because the outbound rule is overly permissive, creating a security risk that makes the configuration incorrect.

Full explanation →

147

Multi-Selectmedium

A security engineer is configuring AWS Config to track changes to security groups in a VPC. The engineer wants to be notified when a security group is modified. Which TWO steps are required to achieve this?

Select 2 answers

A.Configure an SNS topic and subscribe to it to receive notifications when the Config rule triggers.

B.Enable AWS CloudTrail to log security group changes.

C.Enable Amazon GuardDuty to detect security group modifications.

D.Create an AWS Config rule that monitors security group changes.

E.Enable VPC Flow Logs to capture security group activity.

AnswersA, D

SNS can send notifications on Config rule compliance changes.

Why this answer

Options A and D are correct. To monitor security group changes with AWS Config, you need to create an AWS Config rule (option D) that tracks changes to security groups. To receive notifications when the rule triggers, you configure an SNS topic and subscribe to it (option A).

Option B is incorrect because AWS CloudTrail logs API calls to security groups, but Config itself monitors resource configuration changes without requiring CloudTrail. Option C is incorrect because Amazon GuardDuty is a threat detection service, not a configuration change monitor. Option E is incorrect because VPC Flow Logs capture network traffic, not configuration changes.

The common pitfall is assuming CloudTrail or GuardDuty is necessary, but Config's built-in change tracking suffices.

Full explanation →

148

MCQmedium

A security engineer discovers that an IAM user has a policy that allows them to delete any S3 bucket in the account. The engineer wants to audit all delete actions performed by this user. Which AWS service should be used?

A.Amazon GuardDuty

B.AWS Config

C.AWS CloudTrail

D.Amazon CloudWatch Logs

AnswerC

CloudTrail records API calls for auditing.

Why this answer

AWS CloudTrail logs all API calls made to the AWS API, including S3 bucket deletions, and is the appropriate service for auditing user actions. Option C (CloudTrail) is correct. Option A (GuardDuty) is a threat detection service that monitors for malicious activity but does not log all API calls.

Option B (AWS Config) evaluates resource configurations and changes but does not log API calls. Option D (CloudWatch Logs) stores logs from various sources but does not capture API calls by default.

Full explanation →

149

Multi-Selecthard

Which TWO steps should a security engineer take when responding to a confirmed security incident involving a compromised EC2 instance? (Choose 2.)

Select 2 answers

A.Reimage the instance from a clean AMI immediately

B.Delete all CloudTrail logs related to the instance

C.Isolate the instance by changing its security group to deny all traffic

D.Take a snapshot of the instance's EBS volumes for forensic analysis

E.Immediately terminate the instance to stop the attack

AnswersC, D

Isolation prevents further damage while preserving the instance.

Why this answer

Isolating the compromised EC2 instance by changing its security group to deny all traffic immediately stops the attack in progress and prevents lateral movement to other resources, while preserving the instance for forensic analysis. This aligns with the AWS incident response best practice of containment before eradication, as the instance remains intact for investigation.

Exam trap

The trap here is that candidates often confuse 'immediate termination' (Option E) with containment, but AWS incident response frameworks emphasize preserving evidence and isolating rather than destroying the instance, as termination eliminates the ability to perform memory forensics and root cause analysis.

Full explanation →

150

MCQhard

An IAM policy is attached to a user. The user is trying to change their own password in the IAM console but receives an 'Access Denied' error. The user has an MFA device configured and is logged in with MFA. Why is the password change failing?

A.The Allow statement for iam:ChangePassword is not sufficient because the Deny statement explicitly denies all actions.

B.The Deny statement uses 'BoolIfExists' which evaluates to true if the condition key is not present. In the IAM console, the 'aws:MultiFactorAuthPresent' key may not be set, causing the Deny to apply even when the user has MFA.

C.The Deny statement denies all actions unconditionally, so the Allow statement cannot override it.

D.The user does not have permission to change their own password because the Allow statement is not specific enough.

AnswerB

BoolIfExists returns true if the key does not exist, so the Deny applies, blocking all actions including password change.

Why this answer

The Deny statement uses the `BoolIfExists` condition operator with the `aws:MultiFactorAuthPresent` key. In the IAM console, the `aws:MultiFactorAuthPresent` key may not be present in the request context (e.g., during the initial password change flow before MFA is re-validated), causing `BoolIfExists` to evaluate to true when the key is absent. This triggers the Deny even though the user has an MFA device and is logged in with MFA, blocking the `iam:ChangePassword` action.

Exam trap

The trap here is that candidates assume `BoolIfExists` behaves like `Bool` and that MFA presence is always indicated in the request context, but `BoolIfExists` treats a missing key as true, causing the Deny to apply when the key is absent, such as in the IAM console's password change flow.

How to eliminate wrong answers

Option A is wrong because the Deny statement does not explicitly deny all actions; it only denies actions when the condition evaluates to true, so the Allow statement could be sufficient if the condition were not met. Option C is wrong because the Deny statement is not unconditional; it includes a condition (`BoolIfExists`), so it only applies when the condition is true, not to all actions. Option D is wrong because the Allow statement is specific enough (it allows `iam:ChangePassword` for the user's own account), but the Deny overrides it due to the condition evaluation.

Full explanation →

Page 2 of 6

All pages

Practice SCS-C02 by domain

Target a specific domain to shore up weak areas.

Threat Detection and Incident Response Security Logging and Monitoring Identity and Access Management Management and Security Governance Infrastructure Security Data Protection

See all domains with question counts →