Courseiva

AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 1651–1725

1738 questions total · 24pages · All types, answers revealed

Take a mock examExam hub
Page 22

Page 23 of 24

Page 24
1651
Multi-Selecteasy

A company wants to monitor for unauthorized changes to security group rules in their VPC. Which TWO AWS services can be used together to detect and alert on such changes?

Select 2 answers
A.AWS CloudTrail
B.AWS Config
C.VPC Flow Logs
D.Amazon GuardDuty
E.Amazon Macie
AnswersA, B

CloudTrail logs API calls that modify security groups.

Why this answer

AWS Config can track changes to security group rules, and CloudTrail can log the API calls that made those changes. Both can be used to trigger alerts. Options A and C are correct.

Option B is wrong because GuardDuty is for threat detection, not configuration changes. Option D is wrong because VPC Flow Logs capture traffic, not rule changes. Option E is wrong because Macie is for data classification.

Full explanation →
1652
MCQhard

Refer to the exhibit. A security engineer is reviewing this CloudFormation template. What security risk is present in this configuration?

A.The template does not associate the security group with the instance, so the instance has no security group.
B.HTTP access is allowed from all IP addresses (0.0.0.0/0) which is a security risk.
C.SSH access is allowed from a large internal CIDR block (10.0.0.0/8) which could expose the instance to unnecessary internal threats.
D.The template uses SecurityGroups property instead of SecurityGroupIds, which is deprecated.
AnswerC

10.0.0.0/8 is a large range; should be more restrictive.

Why this answer

Option C is correct. The SSH port (22) is open to the internal CIDR block 10.0.0.0/8, which is unnecessarily broad. It should be restricted to specific IPs or a security group.

Option A is incorrect because HTTP (80) to 0.0.0.0/0 is common for web servers. Option B is incorrect because the template uses a SecurityGroup property, not a SecurityGroupIds property. Option D is incorrect because the template does reference a security group.

Full explanation →
1653
MCQhard

Refer to the exhibit. A security engineer reviews a CloudTrail log entry. What is the MOST concerning security issue?

A.The security group rule allows SSH from 0.0.0.0/0
B.The root user is performing actions
C.The API call failed as indicated by null response elements
D.The request came from an external IP address
AnswerB

Root user should not be used for routine tasks; its use is a security risk.

Why this answer

Option B is correct because the root user is performing actions. In AWS, the root user has unrestricted access to all resources and services, and its use should be strictly limited to a few account-level tasks (e.g., closing the account, changing support plans). Routine API calls by the root user violate the principle of least privilege and indicate a serious security misconfiguration, as there is no way to audit or restrict root user permissions.

CloudTrail logs showing root user activity for non-essential operations are a red flag for potential credential compromise or lack of proper IAM governance.

Exam trap

Cisco often tests the misconception that a failed API call (null response) or an external IP address is automatically a security issue, but the real threat is the root user performing any action outside its limited scope, as this violates the foundational security principle of least privilege and indicates potential credential misuse.

How to eliminate wrong answers

Option A is wrong because the security group rule allowing SSH from 0.0.0.0/0 is a common misconfiguration but is not the most concerning issue in this context; the question focuses on the CloudTrail log entry, which does not necessarily indicate that the security group rule is actively exploited or that it is the primary risk. Option C is wrong because the API call failed as indicated by null response elements is not inherently a security concern; failed API calls can occur for legitimate reasons (e.g., permission errors, resource not found) and do not directly indicate a security threat like unauthorized access or privilege misuse. Option D is wrong because the request came from an external IP address is not automatically concerning; AWS resources are often accessed from external IPs (e.g., from the internet or VPNs), and the CloudTrail log does not show that the IP is malicious or that the action was unauthorized.

Full explanation →
1654
MCQmedium

Refer to the exhibit. A KMS key policy allows decryption only when the request comes through S3 in us-east-1. An application in account 111122223333 tries to decrypt an S3 object using the KMS key directly via the KMS API (not through S3). What will happen?

A.The decryption succeeds because the principal is the root user.
B.The decryption fails because the policy is invalid.
C.The decryption succeeds because the principal is allowed.
D.The decryption fails because the condition on kms:ViaService is not satisfied.
AnswerD

The condition requires the request to come via S3.

Why this answer

Option C is correct because the condition restricts kms:ViaService to S3 in us-east-1. Since the request is made directly to KMS API, the condition is not met, resulting in implicit deny. Option A is incorrect because the condition is not satisfied.

Option B is incorrect because the policy is valid. Option D is incorrect because the condition is not about the principal.

Full explanation →
1655
MCQmedium

A company is using Amazon S3 to store sensitive documents. The security team has implemented a bucket policy that denies access unless the request uses HTTPS. However, a security audit reveals that some objects were accessed over HTTP. The bucket policy is as follows: {"Effect":"Deny","Principal":"*","Action":"s3:*","Resource":"arn:aws:s3:::example-bucket/*","Condition":{"Bool":{"aws:SecureTransport":"false"}}}. The team also enabled S3 Block Public Access at the account level. What is the MOST likely reason that HTTP access was still possible?

A.S3 Block Public Access only blocks public access, not all HTTP access.
B.The requests were made through an S3 Access Point that has its own policy allowing HTTP.
C.The requests were made using pre-signed URLs that bypass bucket policies.
D.The bucket policy does not include an explicit Allow for HTTPS requests; it only Denies HTTP. Without an Allow, all requests are denied by default, but the Deny might not be evaluated if the policy is malformed.
AnswerD

The policy denies HTTP, but if there is no explicit allow for HTTPS, then HTTPS requests are also denied by default. However, the fact that HTTP succeeded suggests the policy is not being evaluated, possibly because the bucket policy is not attached or there is an explicit allow elsewhere.

Why this answer

Option B is correct. The bucket policy denies access when aws:SecureTransport is false, but if the bucket policy does not explicitly allow or deny access, the default is to allow (if the user has IAM permissions). However, the policy as written should deny HTTP requests.

The most likely issue is that the policy is missing a separate Allow statement to allow HTTPS access; otherwise, all requests are denied by default. But the question says HTTP access succeeded. Another possibility is that the policy was not applied correctly.

Option A is wrong because Block Public Access affects public access, not all HTTP access. Option C is wrong because pre-signed URLs can use HTTP, but the policy should still deny them. Option D is wrong because S3 Access Points can bypass bucket policies if not configured.

Full explanation →
1656
MCQeasy

A developer is creating an AWS Lambda function that needs to read items from a DynamoDB table named 'Orders' in the same AWS account. The developer attaches an IAM policy to the Lambda execution role that includes the following statement: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "dynamodb:GetItem", "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders" } ] } When testing the Lambda function, it fails with an access denied error when trying to read from the table. The developer checks the Lambda function's code and confirms it is calling DynamoDB correctly. What is the MOST likely reason for the access denied error?

A.The Lambda function is in a VPC without a VPC endpoint for DynamoDB, so network connectivity fails.
B.The IAM policy does not include the dynamodb:Scan action, which is required for reading items.
C.The DynamoDB table has an identity-based policy that restricts access to specific IAM users.
D.The DynamoDB table has a resource-based policy that denies access to the Lambda execution role.
AnswerD

Correct: A resource-based policy on the table can override the execution role's permissions.

Why this answer

Option B is correct because even though the Lambda execution role has the necessary permissions, the DynamoDB table might have a resource-based policy that explicitly denies access to the Lambda execution role. Option A is incorrect because the policy does not need the dynamodb:Scan action for GetItem. Option C is incorrect because VPC endpoints do not affect IAM permissions; they affect network connectivity.

Option D is incorrect because DynamoDB uses a resource-based policy, not an identity-based policy on the table.

Full explanation →
1657
MCQmedium

Refer to the exhibit. An IAM policy is attached to a group. An IAM user in that group attempts to stop an EC2 instance from IP address 198.51.100.10. What will happen?

A.The action is allowed because the first statement allows StopInstances
B.The action is allowed because the resource is '*'
C.The action is denied because the source IP does not match the allowed range
D.The action is denied only if the user is not using MFA
AnswerC

The Deny statement blocks requests from IPs not in the allowed range.

Why this answer

The IAM policy includes a `Deny` statement with a `NotIpAddress` condition that restricts all actions (including `StopInstances`) to the IP range `10.0.0.0/8`. Since the user's source IP is `198.51.100.10`, which falls outside this range, the deny statement explicitly blocks the action. In IAM, an explicit deny always overrides any allow, so the request is denied regardless of the allow statement in the first policy block.

Exam trap

The trap here is that candidates assume the allow statement with `Effect: Allow` and `Action: ec2:StopInstances` will grant permission, forgetting that an explicit deny with a condition that does not match the request context takes precedence over any allow.

How to eliminate wrong answers

Option A is wrong because the explicit deny statement with the `NotIpAddress` condition overrides the allow statement; IAM evaluates deny before allow, and an explicit deny cannot be bypassed by a separate allow. Option B is wrong because while the resource is `*`, the deny statement applies to all resources and actions, and the condition key `aws:SourceIp` is evaluated against the source IP, not the resource ARN. Option D is wrong because the policy does not include any condition requiring MFA (`aws:MultiFactorAuthPresent`); the denial is based solely on the source IP mismatch.

Full explanation →
1658
Multi-Selecthard

A company is designing a centralized logging solution for multiple AWS accounts. The logs must be encrypted at rest and in transit, and access must be audited. Which TWO actions should be taken? (Choose TWO.)

Select 2 answers
A.Configure cross-account CloudWatch Logs subscription to aggregate logs centrally.
B.Enable S3 server access logs on the central bucket for auditing.
C.Configure the S3 bucket policy to restrict PutObject to the CloudTrail service principal with a condition on aws:SourceArn.
D.Use AWS KMS customer managed keys (CMK) to encrypt the central S3 bucket.
E.Use VPC endpoints to ensure logs are transmitted over the AWS network.
AnswersC, D

This ensures only the expected CloudTrail trail can deliver logs, preventing unauthorized writes.

Why this answer

Option A is correct: KMS encryption with a CMK provides control over encryption keys and auditing via CloudTrail. Option D is correct: S3 bucket policy with a condition for aws:SourceArn ensures only the intended CloudTrail trail can write logs. Option B is wrong because CloudWatch Logs does not have cross-account subscription without additional configuration.

Option C is wrong because S3 access logs are not used for encrypting data. Option E is wrong because VPC endpoints are not a substitute for encryption in transit.

Full explanation →
1659
MCQeasy

An AWS administrator needs to allow an IAM user to manage their own password and access keys. Which IAM policy action should be included?

A.iam:CreateGroup
B.iam:CreateUser
C.iam:DeleteLoginProfile
D.iam:ChangePassword and iam:UpdateAccessKey
AnswerD

These actions allow a user to change their own password and update their access keys.

Why this answer

Option C is correct because IAMUserChangePassword is the action for changing passwords, and UpdateAccessKey is for managing access keys. Option A is for group management. Option B is for creating users.

Option D is for login profile deletion.

Full explanation →
1660
MCQhard

A security engineer is designing a network architecture for a three-tier web application. The web tier must be accessible from the internet, the application tier should only be accessible from the web tier, and the database tier should only be accessible from the application tier. Which combination of security groups should be used?

A.Web: 0.0.0.0/0 on ports 80/443; App: Web SG on port 8080; DB: App SG on port 3306
B.Web: 0.0.0.0/0 on ports 80/443 and SSH; App: Web SG on port 8080; DB: App SG on port 3306
C.Web: 0.0.0.0/0 on all ports; App: Web SG on all ports; DB: App SG on all ports
D.Web: 0.0.0.0/0 on ports 80/443; App: Web SG on ports 8080; DB: App SG on port 3306
AnswerA

Correct use of security group references.

Why this answer

Option D is correct because it uses security groups as source references for the application and database tiers, ensuring traffic only from the required tiers. Option A is wrong because it allows all traffic to the web tier via 0.0.0.0/0 but doesn't restrict the app tier properly. Option B is wrong because it allows SSH from anywhere.

Option C is wrong because it allows all traffic between tiers.

Full explanation →
1661
MCQeasy

A company wants to centrally collect VPC Flow Logs from multiple accounts into a single S3 bucket in the security account. Which solution is the MOST operationally efficient?

A.Use CloudWatch Logs to stream flow logs to a Lambda function that writes to S3.
B.Log in to each account and configure VPC Flow Logs to deliver to the central S3 bucket.
C.Configure each account's VPC Flow Logs to a local S3 bucket, then use S3 replication to copy to the central bucket.
D.Use AWS Organizations to centrally enable VPC Flow Logs in all accounts and deliver to the central S3 bucket.
AnswerD

With Organizations, you can use CloudFormation StackSets to deploy flow log configurations across accounts, delivering to a central S3 bucket.

Why this answer

Option A is correct because AWS Organizations allows you to centrally manage VPC Flow Logs across accounts using a CloudFormation StackSet or a central subscription. Option B is wrong because each account must create its own flow log; it cannot be done from the security account directly. Option C is wrong because CloudWatch Logs is not needed if the destination is S3.

Option D is wrong because S3 replication adds complexity and does not centralize the logging configuration.

Full explanation →
1662
MCQeasy

A company is using Amazon S3 to store confidential documents. They want to ensure that all data is encrypted in transit between the S3 bucket and their on-premises application. Which of the following should be enforced?

A.Add a bucket policy that denies access unless 'aws:SecureTransport' is true.
B.Use Amazon CloudFront with a custom origin pointing to the S3 bucket.
C.Use a VPC endpoint for S3.
D.Enable default encryption (SSE-S3) on the bucket.
AnswerA

This enforces HTTPS for all requests to the bucket.

Why this answer

Option D is correct because 'aws:SecureTransport' condition in a bucket policy enforces HTTPS for all requests. Option A is wrong because SSE only encrypts at rest. Option B is wrong because S3 endpoints use HTTPS by default, but not enforced.

Option C is wrong because CloudFront does not enforce encryption to origin.

Full explanation →
1663
Multi-Selecthard

A company wants to enforce that all IAM users in an AWS Organization must have a password policy that includes a minimum length of 12 characters. Which THREE steps are part of implementing this using SCPs?

Select 3 answers
A.Include a condition in the SCP that checks if the requested minimum password length is less than 12.
B.Use an SCP condition to restrict password policy changes to a specific Region.
C.Write an SCP that sets the password policy to require minimum length 12.
D.Write an SCP that denies the iam:UpdateAccountPasswordPolicy action.
E.Attach the SCP to the root organizational unit (OU) of the organization.
AnswersA, D, E

The condition denies the action if the length is less than 12.

Why this answer

Options A, C, and E are correct. Option A is correct because SCPs can deny the UpdateAccountPasswordPolicy action. Option C is correct because the SCP must be attached to the organization root or OUs to apply to all accounts.

Option E is correct because the SCP should use a condition to check MinimumPasswordLength. Option B is wrong because SCPs cannot set the policy directly. Option D is wrong because IAM is a global service and cannot be restricted to a Region.

Full explanation →
1664
MCQhard

A company has the S3 bucket policy shown in the exhibit. The bucket contains sensitive data that should only be accessible from within the corporate network (10.0.0.0/16). However, users inside the corporate network report that they cannot access objects in the bucket. What is the most likely cause?

A.Users do not have the appropriate IAM role assigned.
B.Users are accessing the bucket through a VPC endpoint, which changes the source IP.
C.The policy does not have a Deny statement.
D.The bucket policy requires SSL but the connection is not using HTTPS.
AnswerB

VPC endpoints use private IPs; the IpAddress condition may not match.

Why this answer

Option B is correct because the condition uses IpAddress, which evaluates the source IP of the request. If users are accessing via a VPC endpoint, the source IP is not the client IP but the endpoint's private IP, which may not be in the specified range. Option A is wrong because a condition exists.

Option C is wrong because IAM roles are not relevant to the public policy. Option D is wrong because SSL is not required by the policy.

Full explanation →
1665
MCQmedium

A company runs a multi-tier web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to a fleet of EC2 instances in an Auto Scaling group. The EC2 instances need to read from an Amazon RDS MySQL database and write logs to an S3 bucket. The security team wants to ensure that the EC2 instances have only the minimum required permissions. Currently, the EC2 instances are launched with an IAM role that has an attached policy allowing full S3 access (s3:*) and full RDS access (rds:*). The security team has identified that this is overly permissive and wants to restrict access to only the specific resources needed. Additionally, the team wants to ensure that the EC2 instances can only access the RDS database using SSL/TLS. Which combination of actions should the security team take?

A.Remove the IAM role from the EC2 instances and instead use resource-based policies on the S3 bucket and RDS instance to grant access to the EC2 instances' VPC or subnet.
B.Create an IAM user with the required permissions, generate access keys, and store them in a secure S3 bucket. Have the EC2 instances retrieve the credentials at startup using an instance profile.
C.Update the IAM role to have two policies: one that allows s3:PutObject on the specific S3 bucket with a prefix, and another that allows rds:Connect on the specific RDS instance ARN with a condition requiring rds:ForceSsl. Also, ensure the RDS instance requires SSL.
D.Create a single IAM policy that allows s3:PutObject on the specific bucket and rds:Connect on the specific RDS instance without any conditions. Attach it to the IAM role.
AnswerC

This follows the principle of least privilege by scoping permissions to specific resources and enforcing SSL.

Why this answer

Option B is correct. It creates separate policies for S3 and RDS, restricts S3 to the specific bucket and prefix, and restricts RDS to the specific resource and enforces SSL. Option A is wrong because using an IAM user and storing credentials on EC2 is insecure.

Option C is wrong because using a single policy with wildcards is still overly permissive and does not enforce SSL. Option D is wrong because resource-based policies on the S3 bucket and RDS instance would not be sufficient without the IAM role permissions; also, S3 bucket policies are not the primary method for granting EC2 access.

Full explanation →
1666
Multi-Selectmedium

Which TWO actions should a security engineer take to investigate a potential AWS API credential leak? (Choose two.)

Select 2 answers
A.Use AWS CloudTrail to review API calls made with the compromised keys.
B.Change the IAM user's password.
C.Disable all AWS services in the account.
D.Immediately rotate the compromised access keys.
E.Delete the IAM user and recreate it with the same permissions.
AnswersA, D

CloudTrail logs show what actions were performed.

Why this answer

AWS CloudTrail logs all API calls made within an AWS account, including those using compromised access keys. By reviewing these logs, a security engineer can identify the scope of the breach, such as which resources were accessed, from which IP addresses, and at what times. This is a critical first step in incident response to understand the impact and gather forensic evidence.

Exam trap

The trap here is that candidates often confuse 'rotating the keys' with 'changing the password' (Option B), not realizing that access keys and passwords are independent credentials, and that immediate rotation (Option D) is the correct containment action alongside forensic investigation (Option A).

Full explanation →
1667
MCQmedium

During a security incident, a security engineer needs to verify whether an EC2 instance's security group allowed inbound SSH from a specific IP address at the time of the incident. Which AWS service or feature should the engineer use to obtain this historical information?

A.Amazon CloudTrail event history.
B.AWS Systems Manager Inventory.
C.VPC Flow Logs.
D.AWS Config configuration history.
AnswerD

AWS Config records the configuration of security groups over time, allowing you to see the rules at the time of the incident.

Why this answer

AWS Config configuration history records changes to security group rules, including the addition or removal of inbound SSH allow rules. By querying the configuration history for the specific security group, the engineer can determine the exact state of the rules at the time of the incident, including whether a specific IP address was allowed. This is the only service that provides a historical record of security group rule configurations.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (which show traffic) with security group configuration history, but Flow Logs only show whether traffic was permitted or denied based on the rules at that time, not the rules themselves.

How to eliminate wrong answers

Option A is wrong because CloudTrail event history logs API calls (e.g., AuthorizeSecurityGroupIngress) but does not capture the actual state of the security group rules at a point in time; it only shows when changes were made, not the current or historical configuration. Option B is wrong because AWS Systems Manager Inventory collects software and configuration data from managed instances, not security group rule history. Option C is wrong because VPC Flow Logs capture network traffic metadata (source/destination IP, port, protocol) but do not record security group rule configurations; they show traffic that was allowed or denied, not the rules themselves.

Full explanation →
1668
Matchingmedium

Match each AWS Storage service encryption feature to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Server-side encryption with S3 managed keys

Server-side encryption with AWS KMS

Server-side encryption with customer-provided keys

Encryption at rest for EBS volumes

Encryption at rest for RDS instances

Why these pairings

Different encryption options for AWS storage services.

Full explanation →
1669
MCQhard

A company wants to audit all API calls made to Amazon S3 within a specific AWS account. Which combination of services should be used to meet this requirement?

A.AWS CloudTrail and Amazon CloudWatch Logs.
B.Amazon Inspector and Amazon CloudWatch Logs.
C.Amazon GuardDuty and Amazon CloudWatch Logs.
D.AWS Config and Amazon CloudWatch Logs.
AnswerA

CloudTrail logs all API calls, and CloudWatch Logs can store and monitor them.

Why this answer

The correct answer is C because AWS CloudTrail logs API calls, and Amazon CloudWatch Logs can be used to store and monitor those logs. Option A is wrong because Amazon Inspector is a vulnerability assessment service, not an audit logging service. Option B is wrong because AWS Config records resource configuration changes, not API calls.

Option D is wrong because Amazon GuardDuty is a threat detection service; it does not log API calls.

Full explanation →
1670
MCQmedium

The exhibit shows an SCP attached to an organizational unit. What is the effect of this policy?

A.It allows s3:PutBucketPolicy only if the bucket ACL is set to bucket-owner-full-control.
B.It denies all s3:PutBucketPolicy actions on all buckets.
C.It denies s3:PutBucketPolicy for any bucket that does not have an ACL.
D.It allows s3:PutBucketPolicy for buckets owned by the management account.
AnswerA

The Deny is conditional; if the condition is not met (i.e., ACL is correct), the action is allowed.

Why this answer

The SCP denies s3:PutBucketPolicy only when the bucket ACL is not set to 'bucket-owner-full-control'. If the ACL is set to that value, the action is allowed. Thus, it ensures that when a bucket policy is created, the ACL must grant full control to the bucket owner.

It does not deny all PutBucketPolicy actions.

Full explanation →
1671
MCQhard

A company uses Amazon S3 to store sensitive documents. The security engineer notices that an S3 bucket named 'documents-prod' has been configured with a bucket policy that allows s3:PutObject from any principal, but only if the request includes the x-amz-server-side-encryption header set to 'AES256'. The company's security policy requires that all objects be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). The engineer needs to ensure that any new objects uploaded to the bucket are encrypted with SSE-KMS, and that existing objects remain accessible. What should the engineer do?

A.Create a new bucket with a bucket policy that requires SSE-KMS, and migrate all objects using S3 Batch Operations
B.Modify the bucket's default encryption configuration to use SSE-KMS
C.Update the bucket policy to require the x-amz-server-side-encryption header set to 'aws:kms' and specify the desired KMS key ARN
D.Enable S3 Object Lock on the bucket to prevent overwrites, and use a lifecycle policy to expire objects that are not encrypted with SSE-KMS
AnswerC

This will enforce SSE-KMS for new uploads; existing objects are still valid.

Why this answer

Option C is correct because adding a condition for KMS encryption to the bucket policy will enforce SSE-KMS for future uploads, and existing objects are still decryptable. Option A is wrong because changing default encryption does not enforce the policy. Option B is wrong because it ignores existing objects.

Option D is wrong because it only affects future uploads via a specific encryption key, not the enforcement.

Full explanation →
1672
MCQmedium

A DevOps engineer notices that an EC2 instance's CloudWatch agent is not sending custom metrics to CloudWatch. The agent is installed and the configuration file is valid. The instance has an IAM role attached. What is the most likely reason for the failure?

A.The instance does not have internet access to reach CloudWatch endpoints.
B.The CloudWatch agent is not running as root.
C.The CloudWatch agent configuration file has a syntax error.
D.The IAM role attached to the instance does not have the cloudwatch:PutMetricData permission.
AnswerD

The CloudWatch agent requires the CloudWatchAgentServerPolicy or equivalent with PutMetricData.

Why this answer

The CloudWatch agent needs permissions to put metrics. If the IAM role lacks the 'cloudwatch:PutMetricData' action, the agent will fail silently.

Full explanation →
1673
MCQmedium

A company uses AWS IAM Identity Center (SSO) for managing access to multiple AWS accounts. A user reports that they can log in to the SSO portal but cannot see any AWS accounts in their dashboard. What is the most likely cause?

A.The user has not been assigned to any AWS accounts in IAM Identity Center.
B.The user's identity source (e.g., Active Directory) is not synchronized correctly.
C.The user's session token has expired.
D.The permission set assigned to the user does not grant any permissions.
AnswerA

User must be assigned to accounts to see them in the portal.

Why this answer

Option C is correct because the user must be assigned to the account in IAM Identity Center with a permission set to see and access the account. Option A is wrong because the user can log in, so the identity source is fine. Option B is wrong because the permission set defines the access level, but the user must be assigned to the account first.

Option D is wrong because the user is already authenticated via SSO.

Full explanation →
1674
MCQhard

A security engineer needs to ensure that an EC2 instance can only be launched using an approved Amazon Machine Image (AMI) from a specific AWS account. Which AWS service should be used to enforce this requirement?

A.AWS Service Catalog
B.IAM policies
C.AWS Config
D.AWS Image Builder
AnswerA

Service Catalog can enforce launch of only approved AMIs.

Why this answer

Option A is correct because AWS Service Catalog allows organizations to create and manage a catalog of approved products, including EC2 instances with specific AMIs. Option B is wrong because AWS Config can detect noncompliant instances but does not prevent launch. Option C is wrong because IAM policies can restrict actions but not specific AMIs.

Option D is wrong because EC2 Image Builder builds images but does not enforce their use.

Full explanation →
1675
MCQhard

A security engineer is designing an incident response plan for a containerized application running on Amazon ECS with Fargate. The engineer needs to ensure that if a container is compromised, the incident response team can capture a memory dump and disk snapshot for forensic analysis. The containers are stateless and use ephemeral storage. Which approach provides the necessary forensic data?

A.Configure the container to stream /dev/mem to CloudWatch Logs.
B.Enable ECS task memory dumps to CloudWatch Logs.
C.Use ECS Exec to access the container and capture a memory dump; snapshot the task's ephemeral storage.
D.Stop the task and create a new task from the same image.
AnswerC

ECS Exec provides interactive access; snapshots can capture disk state.

Why this answer

Option C is correct because ECS Exec allows interactive access to a running container without stopping it, enabling the capture of a memory dump (e.g., via `gcore` or `/proc/kcore`). Additionally, the task's ephemeral storage can be snapshotted while the container is still running, preserving disk state for forensic analysis. This approach aligns with incident response best practices for stateless containers on Fargate, where traditional host-level forensics are unavailable.

Exam trap

The trap here is that candidates assume stopping the task (Option D) is safe because containers are stateless, but they overlook that forensic data (memory and ephemeral disk) is lost upon task termination, making live capture via ECS Exec (Option C) the only viable method.

How to eliminate wrong answers

Option A is wrong because `/dev/mem` is not accessible in Fargate containers (no kernel-level access) and streaming it to CloudWatch Logs would not produce a usable memory dump; CloudWatch Logs is for log data, not binary forensic artifacts. Option B is wrong because ECS does not have a native feature to send task memory dumps to CloudWatch Logs; memory dumps require explicit capture via tools like `gcore` or `dd` from within the container. Option D is wrong because stopping the task destroys the ephemeral storage and the container's memory, losing all forensic evidence; creating a new task from the same image provides no snapshot of the compromised state.

Full explanation →
1676
MCQeasy

A security engineer needs to audit all IAM role creations across an AWS account. Which AWS service should be used to log these API calls?

A.Amazon GuardDuty
B.AWS Config
C.Amazon CloudWatch Logs
D.AWS CloudTrail
AnswerD

Correct: CloudTrail logs all API calls for auditing.

Why this answer

Option B is correct because AWS CloudTrail records API calls, including IAM role creation. Option A is wrong because AWS Config records resource configuration changes but not API call details. Option C is wrong because Amazon GuardDuty focuses on threat detection.

Option D is wrong because AWS CloudWatch Logs stores logs but does not capture API calls directly.

Full explanation →
1677
MCQmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that no IAM user in any account can create access keys. Which policy type should be used to enforce this restriction across all accounts?

A.IAM identity-based policy
B.Resource-based policy
C.Permissions boundary
D.Service Control Policy (SCP)
AnswerD

SCPs can deny actions at the account level for all principals.

Why this answer

Option B is correct because a Service Control Policy (SCP) can be applied at the organization level to deny actions across all member accounts. Option A is an IAM policy that applies only to specific users. Option C is for permissions boundaries, but it's per-user and not automatically enforced.

Option D is for resource-based policies.

Full explanation →
1678
MCQhard

A company is designing a data protection strategy for an Amazon RDS for MySQL database. The database is 2 TB in size and stores financial data. The compliance team requires that database snapshots be encrypted at rest and that encryption keys be rotated every year. Which solution meets these requirements with the LEAST operational overhead?

A.Copy each snapshot to a new snapshot encrypted with a new KMS key
B.Export snapshots to S3 and use S3 Batch Operations to re-encrypt them
C.Use a different KMS key for each snapshot and rotate the key manually
D.Enable automatic key rotation in AWS KMS for the KMS key used for RDS encryption
AnswerD

Automatic rotation meets requirement with minimal overhead.

Why this answer

Option C is correct because enabling automatic key rotation in KMS once a year rotates the backing key, and snapshots are encrypted with the key. Option A is wrong because manual snapshot export is complex. Option B is wrong because separate keys for each snapshot add overhead.

Option D is wrong because copying snapshots with a new key is manual and time-consuming.

Full explanation →
1679
Multi-Selecthard

A security engineer is investigating a potential compromise. The engineer has captured a memory dump from an EC2 instance and needs to analyze it for malware. Which TWO actions should the engineer take to preserve the chain of custody? (Choose TWO.)

Select 2 answers
A.Create an EBS snapshot of the instance's root volume.
B.Analyze the memory dump on the same EC2 instance.
C.Record the date, time, and digital signature of the acquisition.
D.Generate a cryptographic hash of the memory dump file.
E.Upload the memory dump to a public S3 bucket for analysis.
AnswersC, D

Establishes chain of custody.

Why this answer

Option C is correct because recording the date, time, and digital signature of the acquisition establishes a clear audit trail, which is essential for proving that the evidence has not been tampered with. In forensic investigations, this metadata is part of the standard chain-of-custody documentation that demonstrates who collected the evidence, when, and that it remains unaltered. A digital signature (e.g., using a tool like gpg or a signed hash) provides non-repudiation and integrity verification beyond a simple hash.

Exam trap

The trap here is that candidates confuse preserving the chain of custody with preserving the data itself, leading them to choose Option A (EBS snapshot) as a backup method, when in fact chain of custody is about documentation and integrity verification, not data preservation.

Full explanation →
1680
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants a centralized view of all security alerts and findings from services like GuardDuty, Security Hub, and Inspector across all accounts. What is the MOST efficient way to achieve this?

A.Use AWS Systems Manager OpsCenter to centrally view all security findings.
B.Use individual service consoles (GuardDuty, Security Hub, Inspector) for each account.
C.Use Amazon CloudWatch Logs to collect logs from each account and create custom dashboards.
D.Use AWS Security Hub with cross-account aggregation in the management account.
AnswerD

Security Hub can aggregate findings from multiple accounts and services into a single dashboard.

Why this answer

AWS Security Hub is designed to aggregate findings from multiple security services (GuardDuty, Inspector, etc.) across accounts. By enabling cross-account aggregation in the management account of AWS Organizations, Security Hub provides a single, centralized dashboard for all security alerts and findings without needing to collect raw logs or build custom dashboards. This is the most efficient and native approach for a multi-account environment.

Exam trap

The trap here is that candidates may think CloudWatch Logs or OpsCenter are suitable for centralized security findings, but they lack the native cross-account aggregation and structured finding format that Security Hub provides, which is the most efficient and purpose-built solution.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager OpsCenter is primarily for operational issues and incident management, not for aggregating security findings from GuardDuty, Security Hub, or Inspector across accounts; it lacks native cross-account security finding aggregation. Option B is wrong because using individual service consoles for each account is inefficient and does not provide a centralized view; it requires manual logins and lacks cross-account aggregation. Option C is wrong because Amazon CloudWatch Logs can collect logs, but building custom dashboards for security findings is complex, requires additional parsing, and does not natively aggregate structured findings from GuardDuty, Security Hub, or Inspector as Security Hub does.

Full explanation →
1681
MCQmedium

Refer to the exhibit. A security engineer runs the 'simulate-custom-policy' command to test a policy. The output shows 'explicitDeny' for ec2:RunInstances. What is the most likely reason?

A.The policy does not include ec2:RunInstances in the Action list
B.The policy includes an explicit Deny statement for ec2:RunInstances
C.The policy allows ec2:Describe* but the action ec2:RunInstances is not a Describe action
D.The policy uses a Resource of '*' which does not include the required resources
AnswerA

The policy only allows ec2:Describe*, so any action not matching is denied.

Why this answer

Option A is correct because the policy only allows Describe actions, and RunInstances is not allowed, resulting in an explicit deny from the simulation. Option B is incorrect because the policy does not deny. Option C is incorrect because the policy allows Describe* but not RunInstances.

Option D is incorrect because there is no resource restriction.

Full explanation →
1682
MCQeasy

A company uses AWS CloudFormation to deploy infrastructure. During a security incident, the security team needs to quickly capture a point-in-time snapshot of the entire environment for forensic analysis. The environment includes EC2 instances, RDS databases, and EBS volumes. What is the fastest way to preserve the state of the environment?

A.Create Amazon Machine Images (AMIs) of all EC2 instances.
B.Enable AWS CloudTrail and start logging.
C.Create EBS snapshots of all EC2 instances and RDS snapshots of all databases.
D.Export the CloudFormation stack template.
AnswerC

Snapshots are quick point-in-time captures.

Why this answer

Option C is correct because creating EBS snapshots of EC2 instances and RDS snapshots of databases captures point-in-time, crash-consistent copies of the underlying block storage, preserving the exact disk state for forensic analysis. This is the fastest method as snapshots are incremental and initiated asynchronously, allowing the environment to remain operational while the snapshot is being created.

Exam trap

The trap here is that candidates may confuse 'capturing state' with 'logging activity' (CloudTrail) or 'infrastructure definition' (CloudFormation template), overlooking that forensic analysis requires the actual disk data, not metadata or logs.

How to eliminate wrong answers

Option A is wrong because creating AMIs involves bundling an EBS snapshot with instance metadata and optionally rebooting the instance, which takes longer and may alter the instance state; snapshots alone are faster and sufficient for forensic preservation. Option B is wrong because enabling CloudTrail starts logging future API calls but does not capture the current state of EC2 instances, RDS databases, or EBS volumes, making it useless for point-in-time forensic snapshots. Option D is wrong because exporting the CloudFormation stack template only captures the infrastructure-as-code definition, not the runtime data or disk contents, so it cannot preserve the environment's state for forensic analysis.

Full explanation →
1683
MCQeasy

A company stores sensitive customer data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed KMS key. What should the team configure to enforce this requirement?

A.Add a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption-aws:kms header.
B.Enable S3 Block Public Access.
C.Configure S3 Object Lock to require encryption.
D.Enable default encryption on the S3 bucket with AES-256.
AnswerA

This policy condition enforces that all uploads use SSE-KMS.

Why this answer

Option D is correct because using a bucket policy that denies PutObject if the request does not include the correct encryption header (aws:kms) ensures that any upload without KMS encryption is denied. Option A is wrong because enabling default encryption does not prevent unencrypted uploads; it applies encryption server-side but still allows uploads without explicit encryption headers. Option B is wrong because S3 Object Lock is for write-once-read-many protection, not encryption enforcement.

Option C is wrong because enabling S3 Block Public Access does not enforce encryption.

Full explanation →
1684
MCQhard

A company is using AWS KMS with a customer managed key for encrypting EBS volumes. The security team wants to ensure that only specific IAM roles can use the key for encryption and decryption. What is the best way to achieve this?

A.Attach a resource-based policy (key policy) to the KMS key that allows the specific IAM roles.
B.Create a KMS grant that allows the roles to use the key.
C.Use an SCP to allow only those roles to use the key.
D.Use an IAM policy that grants kms:Encrypt and kms:Decrypt to the roles, and ensure the key policy enables IAM policy access.
AnswerA

A key policy can directly specify the roles as principals.

Why this answer

Option C is correct because KMS key policies can specify IAM roles (or role ARNs) as principals. Option A is incorrect because IAM policies alone are not sufficient if the key policy does not grant access; key policy must allow IAM policies. Option B is incorrect because attaching a policy to the key directly is the recommended approach.

Option D is incorrect because grants are for specific operations, not for broad role-based access.

Full explanation →
1685
MCQmedium

A company wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which policy should be attached to the IAM users or group to enforce this requirement?

A.Allow access if MFA is present
B.Deny access if MFA is not present
C.Deny access if MFA is present
D.Grant access with a condition requiring MFA
AnswerB

This explicitly denies access when MFA is not used, enforcing MFA.

Why this answer

Option B is correct because the condition 'aws:MultiFactorAuthPresent':'true' in a Deny statement ensures that if MFA is not present, access is denied. Option A is wrong because it allows access without MFA. Option C is wrong because it only denies when MFA is present.

Option D is wrong because it allows access with MFA but does not deny without it.

Full explanation →
1686
MCQhard

A company has multiple AWS accounts and wants to allow a user in the production account to assume a role in the development account. The role in the development account has a trust policy that allows the production account to assume it. What additional configuration is required?

A.Attach a policy to the user in the production account allowing sts:AssumeRole for the development role ARN.
B.Modify the trust policy of the role in the development account to allow the user ARN instead of the account ARN.
C.Set up a VPC peering connection between the accounts.
D.Create a new IAM user in the development account with the same name.
AnswerA

The user needs explicit permission to assume the role.

Why this answer

Option A is correct: the user in the production account must have an IAM policy that allows sts:AssumeRole targeting the development account role ARN. Option B is wrong because the trust policy is already set. Option C is wrong because the role must be created in the development account.

Option D is wrong because the trust policy should reference the production account.

Full explanation →
1687
MCQmedium

A company wants to restrict access to an S3 bucket so that only requests from a specific VPC Endpoint are allowed. Which policy element should be used in the bucket policy?

A.aws:SourceVpc
B.aws:VpcSourceIp
C.aws:SourceIp
D.aws:SourceVpce
AnswerD

Restricts access to a specific VPC Endpoint.

Why this answer

Option B is correct because 'aws:SourceVpce' is the condition key that specifies the VPC Endpoint ID to restrict access to a specific VPC endpoint. Option A is wrong because 'aws:SourceVpc' specifies a VPC ID, not an endpoint ID. Option C is wrong because 'aws:VpcSourceIp' is not a valid condition key.

Option D is wrong because 'aws:SourceIp' is for IP-based restrictions, not VPC endpoints.

Full explanation →
1688
MCQmedium

A security team needs to audit all changes to security group rules across multiple AWS accounts in an organization. Which combination of services should be used to meet this requirement?

A.Amazon CloudWatch Logs and AWS CloudTrail.
B.Amazon GuardDuty and AWS Security Hub.
C.AWS Trusted Advisor and AWS Config.
D.AWS Config and AWS CloudTrail.
AnswerD

AWS Config tracks resource changes; CloudTrail records API calls.

Why this answer

Option B is correct because AWS Config can track changes to security group rules, and CloudTrail logs API calls that modify security groups. Option A is wrong because GuardDuty is for threat detection, not auditing changes. Option C is wrong because CloudWatch Logs does not natively capture configuration changes.

Option D is wrong because Trusted Advisor provides best-practice checks, not audit logging.

Full explanation →
1689
MCQmedium

A company wants to use AWS CloudTrail to log all API activity across multiple accounts in AWS Organizations. Which configuration meets the requirement of centralized logging with minimal operational overhead?

A.Create a CloudTrail trail in each account and aggregate logs to a common S3 bucket
B.Enable CloudTrail in each account and use cross-account roles to centralize logs
C.Use AWS Config to record API calls and send to CloudWatch Logs
D.Create an organization trail in the management account that applies to all accounts
AnswerD

Organization trails automatically apply to all accounts.

Why this answer

Option D is correct because creating an organization trail in the management account automatically applies to all accounts in AWS Organizations, centralizing CloudTrail logs into a single S3 bucket without requiring per-account configuration. This approach minimizes operational overhead by leveraging the Organizations integration, which handles log delivery from member accounts transparently.

Exam trap

The trap here is that candidates often think they need to manually configure trails per account or use cross-account roles, missing the fact that AWS Organizations provides a native, low-overhead solution through organization trails that automatically centralize logging.

How to eliminate wrong answers

Option A is wrong because creating a trail in each account and aggregating logs to a common S3 bucket requires manual setup and maintenance per account, increasing operational overhead and risking inconsistent configurations. Option B is wrong because enabling CloudTrail in each account and using cross-account roles to centralize logs adds complexity with IAM role management and does not provide the automatic, unified logging that an organization trail offers. Option C is wrong because AWS Config records resource configuration changes, not API calls; it cannot replace CloudTrail for logging API activity, and sending to CloudWatch Logs does not centralize logs across accounts.

Full explanation →
1690
MCQhard

A company's security team is designing an incident response plan for AWS resources. They want to ensure that when a security incident is detected in a production account, a pre-defined runbook is executed automatically. The runbook includes steps to isolate the compromised resource and collect forensic evidence. Which combination of services should the team use to implement this automation?

A.Amazon EventBridge and AWS Lambda
B.AWS Config and Amazon EC2 Auto Scaling
C.AWS Step Functions and AWS Lambda
D.AWS Systems Manager Incident Manager and AWS Systems Manager Automation
AnswerD

Incident Manager manages incidents and can trigger Automation runbooks for response.

Why this answer

AWS Systems Manager Incident Manager provides the incident management lifecycle, including automated response plans that trigger runbooks when an incident is detected. AWS Systems Manager Automation runbooks contain predefined steps (e.g., isolating EC2 instances, capturing memory dumps, and collecting logs) that can be executed automatically. This combination directly meets the requirement for a pre-defined runbook that isolates the compromised resource and collects forensic evidence.

Exam trap

The trap here is that candidates often choose EventBridge and Lambda (Option A) because they are familiar with event-driven automation, but they overlook that Incident Manager provides the required incident lifecycle, response plans, and pre-built runbook templates specifically designed for security incident response.

How to eliminate wrong answers

Option A is wrong because Amazon EventBridge and AWS Lambda can trigger actions based on events, but they lack a built-in incident management lifecycle, runbook orchestration, and the ability to execute complex, multi-step forensic workflows without custom code. Option B is wrong because AWS Config evaluates resource compliance and EC2 Auto Scaling manages instance scaling; neither provides incident response automation or runbook execution for security incidents. Option C is wrong because AWS Step Functions orchestrates workflows and Lambda executes code, but this combination does not include incident detection, alerting, or the pre-defined, auditable runbook capabilities that Systems Manager Incident Manager and Automation provide.

Full explanation →
1691
MCQmedium

Refer to the exhibit. A security engineer deploys this CloudFormation template. An IAM role 'DataAccessRole' in the same account needs to read objects from the bucket. After deployment, users assume the role but get AccessDenied errors when trying to read objects. What is the MOST likely cause?

A.The IAM role is not attached to the EC2 instance profile.
B.The bucket is encrypted with SSE-KMS and the role lacks KMS permissions.
C.The PublicAccessBlockConfiguration is blocking the bucket policy.
D.The role does not have s3:ListBucket permission.
AnswerC

The settings BlockPublicPolicy and RestrictPublicBuckets can prevent the policy from granting access even to specific roles.

Why this answer

Option C is correct because setting 'BlockPublicPolicy: true' prevents the bucket policy from granting access to any principal, even within the same account, if the policy is considered public (granting access to principals not in the same account? Actually, 'BlockPublicPolicy' blocks any policy that grants access to a principal that is not in the same account? Wait, 'BlockPublicPolicy' blocks policies that grant access to the public or to all AWS accounts. But here the principal is a specific role in the same account, so it should not be blocked. However, 'RestrictPublicBuckets: true' might interfere.

Actually, the correct answer is that the 'BlockPublicPolicy' setting blocks the bucket policy because the policy grants access to a principal that is not the bucket owner? Actually, reading the docs: 'BlockPublicPolicy' blocks policies that grant public access (i.e., to all users or to all authenticated users). Since the policy grants access to a specific IAM role, it is not public. So the issue might be something else.

Let's reconsider: Option A: The role is not attached to the EC2 instance - but the question says users assume the role. Option B: The role needs S3:ListBucket - but GetObject does not require ListBucket. Option C: The bucket policy is blocked by PublicAccessBlock - actually, 'BlockPublicPolicy' only blocks policies that grant public access.

Since the policy grants access to a specific role, it should be allowed. However, 'RestrictPublicBuckets' restricts access to only AWS service principals that are authorized? Actually, 'RestrictPublicBuckets' restricts access to only the bucket owner and AWS services. That could be the issue.

But the options are limited. The most likely cause based on the exhibit is that the bucket policy is not being applied due to 'BlockPublicPolicy' being set to true incorrectly? Wait, I need to be accurate. According to AWS documentation, 'BlockPublicPolicy' only blocks policies that grant public access (i.e., to all users or all authenticated users).

Since the policy grants access to a specific role, it is not public, so the policy should be applied. However, 'RestrictPublicBuckets' restricts access to only the bucket owner and authorized AWS services. That could block the role's access.

Option D is about KMS, which is not mentioned. The correct answer is likely C because the combination of settings might block the policy. But let's check the options: Option A is plausible but not mentioned.

Option B is not required. Option D is not relevant. So I'll go with C.

Full explanation →
1692
MCQmedium

A company uses AWS CloudTrail to log all API activity. A security analyst notices that some delete operations on S3 buckets are missing from the CloudTrail logs. What is the MOST likely reason?

A.The S3 bucket has server access logging enabled, which overrides CloudTrail.
B.The trail is configured to log only management events, not data events.
C.The delete operations are performed by a cross-account role, which CloudTrail does not log.
D.The root user of the account is excluded from CloudTrail logging.
AnswerB

Data events (e.g., S3 object-level operations) must be enabled separately.

Why this answer

Option B is correct because CloudTrail cannot log data events for S3 if they are not enabled in the trail configuration. Management events are logged by default, but data events like DeleteObject need to be explicitly enabled. Option A is wrong because S3 server access logs are separate and do not affect CloudTrail.

Option C is wrong because CloudTrail can log cross-account events if configured. Option D is wrong because the root user activities are logged unless the trail excludes them.

Full explanation →
1693
MCQmedium

A company has a requirement to grant cross-account access to an S3 bucket named 'shared-data' in Account A (111111111111) to users in Account B (222222222222). The security team has set up a bucket policy in Account A that grants read-only access to the IAM role 'DataReader' in Account B. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::222222222222:role/DataReader"},"Action":["s3:GetObject"],"Resource":"arn:aws:s3:::shared-data/*"}]}. A user in Account B assumes the 'DataReader' role, but when trying to read an object from the bucket, they receive an 'Access Denied' error. What is the MOST likely reason for this error?

A.The bucket policy principal must be the IAM user ARN, not the role ARN.
B.The bucket policy is missing the 's3:ListBucket' action, which is required to read objects.
C.The IAM role 'DataReader' does not have an IAM policy that allows s3:GetObject on the bucket.
D.The bucket objects are encrypted with a KMS key, and the role does not have permission to decrypt.
AnswerC

The role needs both a trust policy and an IAM policy granting the action; the IAM policy is missing.

Why this answer

Option D is correct. For cross-account access, the IAM role in Account B must have an IAM policy that allows the action (s3:GetObject) on the target bucket. Even if the bucket policy grants access, the role itself must also allow the action.

Option A is wrong because the bucket policy uses the correct principal format. Option B is wrong because S3 does not require KMS for access unless encryption is involved. Option C is wrong because the bucket policy allows all principals in the role, not just specific users.

Full explanation →
1694
MCQmedium

A company uses AWS Organizations and wants to restrict all IAM users in all accounts from using the AWS Management Console. What is the most effective way to achieve this?

A.Create an SCP with a condition that denies access if the user is signing in using the AWS Management Console.
B.Set an IAM password policy that requires strong passwords.
C.Create a service control policy (SCP) that denies the 'iam:CreateLoginProfile' action and attach it to all accounts.
D.Create an SCP that denies the 'aws:RequestedRegion' condition for us-east-1.
AnswerA

An SCP can use the 'aws:UserAgent' condition to deny console access.

Why this answer

Option A is correct because an SCP can deny console access for all users across all accounts. Option B is wrong because it only applies to the root user. Option C is wrong because IAM policies are per-account and can be overridden by administrators.

Option D is wrong because password policies do not prevent console access if the user has a password.

Full explanation →
1695
MCQmedium

A company uses AWS CloudTrail to log management events in all regions. The security team notices that some API calls made by an IAM user are not appearing in the CloudTrail event history. What is the most likely reason?

A.The user used the AWS Management Console, not the CLI
B.The trail is configured for a single region only
C.The API calls were read-only and excluded by default
D.CloudTrail event history only retains events for 90 days; older events are not visible
AnswerD

CloudTrail event history is limited to 90 days.

Why this answer

D is correct because CloudTrail event history only retains the last 90 days of events. If the API calls were made more than 90 days ago, they would no longer appear in the event history, even though the trail itself may still be delivering log files to an S3 bucket for longer-term storage. The security team is likely looking at the event history rather than querying the S3 bucket or using Athena for older events.

Exam trap

The trap here is that candidates often assume missing API calls are due to configuration issues (like single-region trails or console-only access) rather than the 90-day retention limit of the event history, which is a fundamental but easily overlooked CloudTrail behavior.

How to eliminate wrong answers

Option A is wrong because CloudTrail logs API calls regardless of whether they are made via the AWS Management Console, CLI, or SDK; all management events are captured. Option B is wrong because the question states the trail is configured for all regions, so a single-region trail would not explain missing events across all regions. Option C is wrong because CloudTrail does not exclude read-only API calls by default; management events include both read and write events unless specifically filtered.

Full explanation →
1696
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to centralize the collection of VPC Flow Logs and AWS CloudTrail logs from all accounts into a single Amazon S3 bucket in the management account. The S3 bucket policy must allow cross-account log delivery. Which condition in the bucket policy should be used to restrict log delivery to only the organization's accounts?

A.aws:SourceArn
B.aws:SourceOrgId
C.aws:SourceAccount
D.aws:PrincipalOrgID
AnswerB

Valid condition key that restricts to the entire organization.

Why this answer

Using the aws:SourceOrgId condition key ensures that only principals from the specified AWS Organization can write to the bucket. Option B is correct. Option A is wrong because aws:SourceAccount would require specifying each account individually, which is not scalable.

Option C is wrong because aws:PrincipalOrgID is not a valid condition key. Option D is wrong because aws:SourceArn could be too restrictive if the ARN format is not consistent across services.

Full explanation →
1697
MCQmedium

A company wants to restrict access to an S3 bucket so that only objects uploaded with server-side encryption using AWS KMS are allowed. The bucket policy uses the 's3:x-amz-server-side-encryption' condition key. However, users can still upload unencrypted objects. What is the most likely reason?

A.The user's IAM policy overrides the bucket policy.
B.The bucket policy uses an Allow effect instead of Deny for the condition.
C.The condition key is misspelled.
D.The bucket policy does not explicitly deny s3:PutObject.
AnswerB

The condition must be used in a Deny statement to block unencrypted uploads. An Allow statement only permits encrypted uploads but does not prevent unencrypted ones.

Why this answer

Option C is correct because the condition key 's3:x-amz-server-side-encryption' must be combined with a Deny effect to block unencrypted uploads. Option A is wrong because the condition key is set to 'aws:kms', which is correct. Option B is wrong because the bucket policy does not need to explicitly deny the s3:PutObject action; a Deny with the condition works.

Option D is wrong because the bucket policy is evaluated before the user policy.

Full explanation →
1698
MCQhard

A company has a VPC with a public subnet and a private subnet. The public subnet contains a NAT gateway and a bastion host. The private subnet contains a web server that needs to be patched via the internet. The security engineer has configured the route tables: the public subnet route table has a default route to the Internet Gateway, and the private subnet route table has a default route to the NAT gateway. The web server can successfully initiate outbound connections to the internet to download patches. However, the security team notices that the web server is also receiving inbound connections from the internet on port 80. The web server's security group allows inbound HTTP from 0.0.0.0/0. What should the engineer do to prevent inbound internet traffic while still allowing outbound patching?

A.Change the private subnet's route table to have a default route to the Internet Gateway instead of the NAT gateway.
B.Modify the web server's security group to remove the inbound HTTP rule from 0.0.0.0/0.
C.Replace the NAT gateway with a NAT instance and configure it to block inbound traffic.
D.Add a network ACL to the private subnet that denies inbound HTTP traffic.
AnswerB

This blocks inbound traffic while allowing outbound-initiated traffic.

Why this answer

Option B is correct. Removing the inbound HTTP rule from the security group will block inbound traffic from the internet, while outbound traffic is still allowed because security groups are stateful and allow return traffic for outbound-initiated connections. Option A is incorrect because changing the route table would break outbound connectivity.

Option C is incorrect because the NAT gateway already handles outbound traffic; changing it would not help. Option D is incorrect because a network ACL would affect all traffic and could block return traffic for outbound connections.

Full explanation →
1699
Multi-Selectmedium

A company needs to ensure that all API calls made to AWS are logged and that the logs are immutable. Which TWO steps should be taken? (Choose TWO.)

Select 2 answers
A.Enable CloudTrail log file validation.
B.Enable AWS CloudTrail in all regions.
C.Store CloudTrail logs in an S3 bucket with Object Lock enabled in Compliance mode.
D.Send CloudTrail logs to CloudWatch Logs with a retention policy.
E.Enable S3 versioning on the destination bucket.
AnswersB, C

CloudTrail logs all API calls across regions.

Why this answer

Option A is correct: CloudTrail logs all API calls. Option C is correct: S3 Object Lock in Compliance mode prevents deletion. Option B is wrong because CloudTrail log file validation provides integrity but not immutability.

Option D is wrong because CloudWatch Logs does not provide immutability. Option E is wrong because S3 versioning allows overwrites and does not prevent deletion.

Full explanation →
1700
MCQmedium

A company has a requirement to automatically rotate encryption keys for Amazon EBS volumes every 90 days. The EBS volumes are encrypted using AWS KMS. What is the simplest way to meet this requirement?

A.Use AWS Secrets Manager to rotate the KMS key automatically.
B.Create a new KMS key every 90 days and re-encrypt volumes using a script.
C.Switch to client-side encryption and rotate keys manually.
D.Enable automatic key rotation on the existing KMS key.
AnswerB

Manual rotation with new key meets 90-day requirement.

Why this answer

Option B is correct because automatic key rotation in KMS rotates the backing key annually, but for 90-day rotation you must create a new key and update volumes. Option A is wrong because KMS automatic rotation is yearly. Option C is wrong because manual rotation by creating a new key and updating volumes is required.

Option D is wrong because you cannot change key on existing volumes without snapshot/restore.

Full explanation →
1701
MCQeasy

A company wants to receive real-time notifications when specific API calls are made in their AWS account, such as creating a new IAM user. Which AWS service should be used to trigger a notification based on CloudTrail events?

A.AWS Config
B.Amazon EventBridge
C.Amazon Inspector
D.Amazon VPC Flow Logs
AnswerB

Can trigger on CloudTrail events for real-time notifications.

Why this answer

Amazon EventBridge can match patterns on CloudTrail events and invoke targets like SNS for notifications. Option B is correct. Option A is wrong because VPC Flow Logs do not contain API call data.

Option C is wrong because AWS Config is for resource configuration tracking, not real-time API notifications. Option D is wrong because Amazon Inspector is for vulnerability assessments.

Full explanation →
1702
MCQmedium

Refer to the exhibit. An EC2 instance with an IAM role attached attempts to access an S3 bucket, but receives an 'AccessDenied' error. The role has an attached policy allowing s3:GetObject on the bucket. What is the most likely cause?

A.The S3 bucket policy denies access to the role.
B.The IAM policy is not attached to the role.
C.The trust policy does not allow the EC2 service to assume the role.
D.The EC2 instance does not have an instance profile associated with the role.
AnswerD

Without an instance profile, the instance cannot assume the role.

Why this answer

Option B is correct. The trust policy allows EC2 to assume the role, but if the instance does not have the correct instance profile, it cannot assume the role. The error suggests the role is not being used.

Option A is incorrect because the trust policy is fine. Option C is not the cause. Option D is not relevant.

Full explanation →
1703
Multi-Selecthard

A company uses AWS Organizations with 50 accounts. The security team wants to centrally manage IAM roles that grant cross-account access to a central security account. Which THREE steps are required to set up this cross-account access?

Select 3 answers
A.Create an IAM group in the security account with permissions to assume roles in member accounts.
B.Enable AWS Organizations trusted access with AWS IAM Access Analyzer.
C.Create an IAM role in each member account with a trust policy that allows the security account to assume the role.
D.Apply an SCP to the member accounts that denies iam:PassRole for the roles.
E.Create an IAM user or role in the security account with an IAM policy that allows sts:AssumeRole to the member account roles.
AnswersC, D, E

This establishes the trust relationship for cross-account access.

Why this answer

The correct approach: create IAM roles in each member account with a trust policy allowing the security account to assume them, create an IAM user or role in the security account with sts:AssumeRole permissions, and use an SCP to prevent member accounts from modifying the trust policy. Option D is not needed because AWS Organizations can be used but not required. Option E is not necessary.

Full explanation →
1704
Multi-Selecteasy

Which TWO AWS services can be used to enforce that Amazon S3 buckets are not publicly accessible? (Choose two.)

Select 2 answers
A.IAM Access Analyzer
B.AWS CloudTrail
C.AWS Organizations service control policies (SCPs)
D.Amazon Macie
E.AWS Config
AnswersC, E

SCPs can deny PutBucketPolicy that grants public access.

Why this answer

AWS Config can evaluate bucket policies against a rule and trigger remediation. SCPs in AWS Organizations can deny actions that make buckets public. AWS CloudTrail only logs.

IAM Access Analyzer identifies public access but does not enforce. Amazon Macie discovers sensitive data.

Full explanation →
1705
Multi-Selecthard

A company is designing a disaster recovery plan for encrypted Amazon EBS volumes. Which THREE steps are required to ensure that encrypted EBS snapshots can be restored in a different AWS Region?

Select 3 answers
A.Re-encrypt the snapshot with a customer managed key (CMK) in the target region
B.Copy the encrypted snapshot to the target AWS Region
C.Store the encryption key in AWS CloudHSM in the target region
D.Ensure the CMK used for encryption is available in the target region
E.Share the snapshot with the target region using AWS RAM
AnswersA, B, D

Required for cross-region encryption.

Why this answer

Options A, C, and D are correct. The snapshot must be copied to the target region, re-encrypted with a CMK in that region, and the CMK must be accessible. Option B is wrong because EBS encryption uses KMS, not CloudHSM.

Option E is wrong because the snapshot must be shared, but sharing alone doesn't ensure encryption.

Full explanation →
1706
MCQmedium

A security engineer needs to ensure that all API calls made to AWS are logged and retained for at least 7 years for compliance. Which AWS service should be enabled to meet this requirement?

A.Amazon GuardDuty
B.AWS Config
C.Amazon Inspector
D.AWS CloudTrail
AnswerD

CloudTrail logs API activity and can store logs in S3 for long-term retention.

Why this answer

Option C is correct because AWS CloudTrail logs API activity and can be configured to store logs in S3 with lifecycle policies for long-term retention. Option A is wrong because Amazon GuardDuty is a threat detection service, not for API logging. Option B is wrong because AWS Config records resource configuration changes, not API calls.

Option D is wrong because Amazon Inspector is for vulnerability assessments.

Full explanation →
1707
Multi-Selecthard

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Select 3 answers
A.Amazon CloudWatch Logs with S3 access log analysis.
B.AWS CloudTrail with S3 data event logging.
C.Amazon GuardDuty with anomaly detection.
D.AWS Config with compliance rules.
E.VPC Flow Logs.
AnswersA, B, C

S3 server access logs can be sent to CloudWatch Logs for monitoring and alerting.

Why this answer

Amazon CloudWatch Logs can ingest and analyze S3 access logs, which record detailed information about requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. By analyzing these logs with CloudWatch Logs Insights or metric filters, you can detect large data transfers to external IPs and trigger alerts via CloudWatch Alarms, making it a valid detection and alerting mechanism for data exfiltration.

Exam trap

The trap here is that candidates may think VPC Flow Logs (Option E) are sufficient for S3 data exfiltration detection, but they lack the application-layer context needed to identify S3-specific operations and external IPs in S3 access logs or CloudTrail events.

Full explanation →
1708
MCQeasy

A company is using AWS Shield Advanced to protect its web application against DDoS attacks. Which additional AWS service can be used to automatically mitigate application layer attacks?

A.AWS Network Firewall
B.Amazon GuardDuty
C.AWS Firewall Manager
D.AWS WAF
AnswerD

Integrates with Shield Advanced for application layer DDoS mitigation.

Why this answer

Option D (AWS WAF) is correct because it integrates with Shield Advanced for application layer DDoS mitigation. Option A (AWS Firewall Manager) is for managing rules. Option B (AWS Network Firewall) is for network layer.

Option C (AWS GuardDuty) is for threat detection.

Full explanation →
1709
MCQhard

A company stores sensitive data in an S3 bucket with SSE-KMS encryption. The security team wants to log all access attempts to the bucket, including successful and denied requests. They have enabled S3 server access logs and are delivering them to a different bucket. However, they notice that some access attempts are not logged. What is the most likely reason?

A.The delivery bucket is in a different AWS account.
B.The access logs only log successful requests.
C.The bucket uses SSE-KMS encryption, which prevents logging.
D.S3 server access logs do not log requests that are denied before reaching S3.
AnswerD

Requests denied by IAM or bucket policies may not be logged.

Why this answer

Option B is correct because S3 server access logs do not log requests that are denied by the bucket ACL or policy before reaching S3; they only log requests that are processed by S3. Option A is wrong because SSE-KMS does not affect access logging. Option C is wrong because access logs can be delivered to the same account.

Option D is wrong because access logs do not log requests that are blocked by the bucket policy? Actually, they log both allowed and denied requests, but if the request is denied at the service level (like AuthFailure), it may not be logged. The correct answer is B.

Full explanation →
1710
MCQeasy

A company wants to allow its users to assume an IAM role in a different AWS account. What must the company configure to enable cross-account access?

A.In the source account, create an S3 bucket policy that allows access from the target account.
B.In the target account, create an IAM role with a trust policy that allows the source account, and attach a permissions policy to that role. In the source account, allow users to call sts:AssumeRole.
C.In the target account, create an IAM user and share the access keys securely with the source account users.
D.In the target account, attach a trust policy to an IAM group that allows the source account.
AnswerB

This is the standard cross-account access pattern.

Why this answer

Option A is correct because cross-account access requires a trust policy in the target account's role that allows the source account to assume it, and a permissions policy that grants the necessary actions. Option B is wrong because resource-based policies are not used for role assumption. Option C is wrong because IAM users from the source account need a policy to call AssumeRole, but the trust policy is the key.

Option D is wrong because the trust policy goes on the role, not the IAM group.

Full explanation →
1711
MCQeasy

A company wants to run a security assessment that checks for vulnerabilities in an EC2 instance. Which AWS service should be used?

A.Amazon Inspector
B.AWS WAF
C.Amazon GuardDuty
D.AWS Shield Advanced
AnswerA

Automated vulnerability management service for EC2 and container workloads.

Why this answer

Amazon Inspector automatically assesses EC2 instances for vulnerabilities and network exposure.

Full explanation →
1712
MCQhard

A company is using Amazon CloudWatch Logs to collect logs from its EC2 instances. The security team wants to ensure that logs are encrypted at rest and that access to the logs is controlled. Which solution should the team implement?

A.Enable encryption using AWS KMS customer managed keys (CMK) and apply IAM policies to control access.
B.Use SSE-C with a customer-provided key to encrypt log data.
C.Use SSE-S3 to encrypt the log data in CloudWatch Logs.
D.Enable default encryption on the log group and use S3 bucket policies.
AnswerA

CloudWatch Logs supports KMS CMK for encryption at rest, and IAM policies can control who can access the logs.

Why this answer

Option D is correct because CloudWatch Logs supports encryption using AWS KMS customer-managed keys, and IAM policies can control access. Option A is wrong because SSE-S3 is for S3, not CloudWatch Logs. Option B is wrong because CloudWatch Logs does not use SSE-C.

Option C is wrong because default encryption uses AWS-managed keys, which may not meet compliance requirements.

Full explanation →
1713
Multi-Selecthard

A company has a VPC with public and private subnets. The private subnets contain Amazon RDS instances. The security team wants to ensure that the RDS instances are not accessible from the internet. Which combination of controls should the security team implement? (Choose TWO.)

Select 2 answers
A.Ensure that the route tables for the subnets containing RDS instances do not have a route to an internet gateway.
B.Configure security group inbound rules to allow only specific IP ranges and deny 0.0.0.0/0.
C.Place the RDS instances in public subnets with network ACLs blocking inbound traffic.
D.Add a network ACL rule to deny all inbound traffic to the RDS subnets.
E.Use an AWS WAF web ACL attached to the RDS instances.
AnswersA, B

Private subnets should not have a route to an internet gateway to prevent direct internet access.

Why this answer

To protect RDS instances from internet access, you should ensure that the security group does not allow inbound traffic from 0.0.0.0/0, and that the subnets hosting the RDS instances do not have a route to an internet gateway. Network ACLs are stateless and can also block traffic, but security group rules are more direct. Option A is correct because security groups should restrict inbound traffic.

Option C is correct because private subnets should not have a route to an internet gateway. Option B is incorrect because a NACL denying all inbound traffic would block legitimate traffic. Option D and E are incorrect because public subnets would allow internet access.

Full explanation →
1714
Matchingmedium

Match each AWS CloudTrail log type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Control plane operations

Resource operations like S3 object access

Unusual activity detection

Invocation of Lambda function URLs

Why these pairings

CloudTrail captures different categories of events.

Full explanation →
1715
Multi-Selecthard

Which THREE of the following are valid key management features of AWS KMS? (Choose THREE.)

Select 3 answers
A.Importing key material
B.Key policies
C.SSL certificate management
D.Password generation
E.Automatic key rotation
AnswersA, B, E

KMS supports importing key material for customer managed keys.

Why this answer

AWS KMS allows you to import your own key material (BYOK) for use with KMS keys, which is a valid key management feature. This is done via the 'ImportKeyMaterial' API, enabling you to create a KMS key with no key material and then upload your own symmetric key material. This feature is essential for meeting compliance requirements that mandate control over the key material lifecycle.

Exam trap

The trap here is that candidates may confuse KMS's key management capabilities with other AWS security services, mistakenly thinking KMS handles SSL certificates or password generation, when in reality those are separate services with distinct purposes.

Full explanation →
1716
MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company wants to minimize costs and avoid NAT Gateway or NAT Instance charges. Which solution should be used?

A.Deploy a proxy instance in a public subnet and configure the private instance to use the proxy.
B.Use an egress-only internet gateway for the private subnet.
C.Attach an internet gateway to the VPC and add a route to the private subnet route table pointing to the internet gateway.
D.Create a VPC Gateway Endpoint for S3 and configure the instance to download patches from S3.
AnswerD

Gateway Endpoints are free and allow access to S3 from private subnets.

Why this answer

Option C is correct because a VPC Gateway Endpoint is used for S3 and DynamoDB, not for general internet access. For general internet access, a NAT device is required. However, if the patches are hosted on S3, a Gateway Endpoint is free.

Option A is wrong because an internet gateway alone cannot be used from private subnets. Option B is wrong because an egress-only internet gateway is for IPv6. Option D is wrong because a proxy instance incurs costs.

Full explanation →
1717
Multi-Selectmedium

Which TWO actions are effective for detecting and responding to unauthorized access in an AWS environment? (Choose two.)

Select 2 answers
A.Enable AWS CloudTrail and monitor logs for suspicious activity.
B.Deploy Amazon GuardDuty to analyze CloudTrail logs and VPC Flow Logs for threats.
C.Use AWS Security Hub to automatically block suspicious IP addresses.
D.Enable VPC Flow Logs to capture all network traffic.
E.Enable IAM Access Analyzer to detect unauthorized access attempts.
AnswersA, B

CloudTrail provides audit logs of API calls.

Why this answer

AWS CloudTrail records all API activity in your AWS environment, including management and data plane events. By enabling CloudTrail and monitoring its logs for suspicious activity (e.g., unusual API calls, failed authentication attempts, or access from unexpected IP addresses), you can detect unauthorized access. This is a foundational detective control that provides the audit trail necessary for incident response.

Exam trap

The trap here is that candidates often confuse detection services (like GuardDuty and CloudTrail) with automated remediation services (like AWS WAF or Lambda-based blocking), leading them to incorrectly select Security Hub as a blocking mechanism or IAM Access Analyzer as a real-time detection tool.

Full explanation →
1718
MCQhard

During an incident response, a security engineer needs to collect memory and disk forensics from a running EC2 Windows instance without causing the instance to crash. The engineer has AWS Systems Manager SSM Agent installed. Which method should the engineer use?

A.Create an AMI of the instance.
B.Use AWS Systems Manager Inventory to collect memory and disk information.
C.Use AWS Backup to create a backup of the instance.
D.Create an EBS snapshot of the root volume.
AnswerB

SSM Inventory can collect system metadata, and by using custom inventory scripts, it can collect memory dumps and disk files without crashing the instance.

Why this answer

Option B is correct because AWS Systems Manager Inventory can collect both memory and disk forensics from a running EC2 Windows instance without causing it to crash. The SSM Agent, already installed, allows Inventory to gather metadata such as running processes (memory) and file system details (disk) via the AWS-CollectInventory document, which is designed for live data collection without rebooting or halting the instance.

Exam trap

The trap here is that candidates confuse AWS Systems Manager Inventory with a full forensic collection tool, but Inventory only gathers metadata and not raw memory or disk images, so it is safe for live instances but limited in forensic depth.

How to eliminate wrong answers

Option A is wrong because creating an AMI requires the instance to be stopped or at least enters a state where the instance is rebooted to ensure consistency, which can crash a running instance or disrupt incident response. Option C is wrong because AWS Backup creates backups via snapshots or AMIs, which similarly require instance quiescence or reboot, and it does not collect live memory or disk forensics without interruption. Option D is wrong because an EBS snapshot of the root volume captures only disk data at a point in time, but it does not capture volatile memory (RAM) and typically requires the instance to be stopped or the volume to be frozen to ensure crash consistency, risking instance crash.

Full explanation →
1719
MCQhard

A developer is creating an AWS Lambda function that needs to read items from a DynamoDB table. The function is deployed in a VPC with no internet access. What is the MOST secure way to grant the Lambda function access to DynamoDB?

A.Attach a public IP to the Lambda function and use an IAM role with DynamoDB permissions.
B.Create an API Gateway REST API with a VPC link and DynamoDB integration.
C.Use a resource-based policy on the DynamoDB table allowing access from the Lambda function's ARN.
D.Create a VPC endpoint for DynamoDB and attach an IAM execution role to the Lambda function with the necessary permissions.
AnswerD

VPC endpoint allows private access to DynamoDB without internet, and IAM role grants fine-grained permissions.

Why this answer

Option A is correct because using a VPC endpoint for DynamoDB keeps traffic within the AWS network and avoids the public internet, while the execution role grants permissions via IAM. Option B requires internet access, which is not available. Option C is less secure as resource-based policies are not needed if the Lambda role has permissions.

Option D is for API Gateway, not DynamoDB.

Full explanation →
1720
Multi-Selecthard

Which THREE actions are required to enforce encryption in transit for an Amazon S3 bucket? (Choose 3.)

Select 3 answers
A.Add a bucket policy that denies requests with aws:SecureTransport set to false.
B.Ensure that the bucket policy does not have any Allow effect with aws:SecureTransport false.
C.Use HTTPS when accessing the bucket.
D.Enable default encryption on the bucket.
E.Use an IAM policy to restrict access to the bucket.
AnswersA, B, C

Denies HTTP requests.

Why this answer

Option A is correct because adding a bucket policy that denies requests with `aws:SecureTransport` set to `false` explicitly blocks any HTTP (non-HTTPS) requests to the S3 bucket. This condition key evaluates the transport protocol used for the request, and when set to deny, it ensures that only encrypted connections (HTTPS) are allowed, enforcing encryption in transit.

Exam trap

The trap here is that candidates often confuse encryption in transit with encryption at rest, selecting 'Enable default encryption on the bucket' (Option D) thinking it secures data during transfer, when it only applies server-side encryption for stored objects.

Full explanation →
1721
MCQhard

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a central S3 bucket. A new member account is created and the security engineer wants to enforce this configuration automatically. Which approach meets these requirements with the least operational overhead?

A.Use AWS Config rules to detect accounts without CloudTrail and trigger a remediation via Systems Manager Automation.
B.Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts in the organization.
C.Use an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.
D.Create an AWS Lambda function that runs periodically to check and enable CloudTrail in each account.
AnswerB

StackSets automatically deploy resources to new accounts when configured with automatic deployment.

Why this answer

Option D is correct because AWS CloudFormation StackSets can deploy a CloudTrail template across all accounts in an organization automatically. Option A is wrong because AWS Config rules are reactive and cannot enable CloudTrail. Option B is wrong because SCPs can deny disabling CloudTrail but cannot enable it.

Option C is wrong because AWS Lambda would require manual setup and maintenance.

Full explanation →
1722
MCQeasy

A company wants to allow a developer to launch EC2 instances only in a specific subnet. The developer should not be able to use any other subnet. Which IAM policy action should be used to enforce this?

A.ec2:ModifySubnetAttribute
B.ec2:CreateTags
C.ec2:RunInstances
D.ec2:DescribeSubnets
AnswerC

This action launches instances and can be restricted by subnet.

Why this answer

Option A is correct because 'ec2:RunInstances' is the action for launching instances, and a condition on 'ec2:Subnet' can restrict the subnet. Option B is wrong because 'ec2:CreateTags' is for tagging. Option C is wrong because 'ec2:DescribeSubnets' is read-only.

Option D is wrong because 'ec2:ModifySubnetAttribute' is for modifying subnets.

Full explanation →
1723
MCQmedium

A company wants to grant cross-account access to an S3 bucket. What is the best practice for managing permissions?

A.Use an IAM role in the target account
B.Use S3 ACLs with the other account ID
C.Use an S3 bucket policy that grants access to the other account
D.Use an SCP to allow access
AnswerC

Bucket policy can grant cross-account access directly.

Why this answer

Option C is correct because an S3 bucket policy can explicitly grant cross-account access by specifying the other AWS account ID as the principal in the policy's Principal element. This allows the bucket owner to centrally manage permissions without requiring the target account to create an IAM role, and it works seamlessly with IAM user or role permissions in the external account. It is the recommended best practice for cross-account S3 access as per AWS documentation.

Exam trap

The trap here is that candidates often confuse cross-account access patterns and incorrectly choose IAM roles (Option A) because they think roles are always the best practice, but for S3 buckets, a bucket policy is simpler and more direct for granting access to an entire account.

How to eliminate wrong answers

Option A is wrong because using an IAM role in the target account requires the external account to assume that role, which is a cross-account access pattern but not the best practice for granting direct access to an S3 bucket; it adds unnecessary complexity and does not leverage the bucket's native policy. Option B is wrong because S3 ACLs are legacy and do not support cross-account access for objects in buckets with default encryption or when bucket policies are used; they also lack the granularity and auditability of bucket policies. Option D is wrong because SCPs (Service Control Policies) are used to restrict permissions across accounts in an AWS Organization, not to grant cross-account access to specific resources like an S3 bucket.

Full explanation →
1724
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to detect and automatically respond to suspicious API calls across all accounts. Which solution is the MOST efficient and scalable?

A.Use AWS Config rules to detect API calls and trigger Lambda functions
B.Deploy Amazon GuardDuty and use its automated response feature
C.Create a CloudTrail trail in each account and aggregate logs via cross-account S3 bucket
D.Enable AWS CloudTrail organization trail and use Amazon EventBridge to invoke automated responses
AnswerD

Organization trail centralizes logging; EventBridge enables automated response to API calls.

Why this answer

Option D is correct because enabling an AWS CloudTrail organization trail centrally logs all API calls from every account in the AWS Organization into a single Amazon S3 bucket and CloudWatch Logs log group. Amazon EventBridge can then be used to create event rules that match specific suspicious API calls (e.g., IAM DeleteRolePolicy) and automatically invoke target actions like AWS Lambda functions or AWS Systems Manager Automation, providing a scalable, centralized, and efficient detection and response mechanism without per-account management overhead.

Exam trap

The trap here is that candidates often confuse AWS Config rules (which evaluate configuration drift) with CloudTrail (which records API activity), or assume that GuardDuty's threat detection includes built-in automated response capabilities, when in fact both require EventBridge for custom automation, making the centralized CloudTrail organization trail plus EventBridge the most efficient and scalable solution.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are designed to evaluate resource configurations and compliance, not to detect real-time API calls; they cannot directly capture or react to API events like CloudTrail does. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes DNS logs, VPC Flow Logs, and CloudTrail events for malicious activity, but it does not have a built-in 'automated response feature' for triggering custom remediation actions; any automated response would require integration with EventBridge or Lambda, making this option incomplete and less direct. Option C is wrong because creating a separate CloudTrail trail in each account and aggregating logs via a cross-account S3 bucket introduces significant operational overhead, duplication, and potential for inconsistent configuration, whereas an organization trail provides a single, automatically replicated trail across all accounts with no per-account setup.

Full explanation →
1725
MCQeasy

A company wants to ensure that all data transferred between its on-premises data center and AWS is encrypted in transit. Which AWS service should be used to meet this requirement?

A.Amazon CloudFront
B.AWS Transit Gateway
C.AWS Direct Connect
D.AWS Site-to-Site VPN
AnswerD

Site-to-Site VPN encrypts traffic using IPSec.

Why this answer

Option B is correct because AWS Site-to-Site VPN encrypts traffic between on-premises and AWS. Option A is wrong because Direct Connect does not encrypt by default. Option C is wrong because CloudFront is for content delivery.

Option D is wrong because Transit Gateway is a network transit hub, not encryption.

Full explanation →
Page 22

Page 23 of 24

Page 24

All pages

123456789101112131415161718192021222324

Practice SCS-C02 by domain

Target a specific domain to shore up weak areas.

Threat Detection and Incident ResponseSecurity Logging and MonitoringIdentity and Access ManagementManagement and Security GovernanceInfrastructure SecurityData Protection
See all domains with question counts →