AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 151–225

Option A is correct because SSE-C requires x-amz-server-side-encryption-customer-algorithm to be set to AES256. Option B is wrong because that header is for SSE-S3. Option C is wrong for SSE-KMS.

Option D is wrong because the key header must be provided separately.

Option D is correct because it uses a public subnet for the NAT Gateway and the ALB, private subnets for web servers (with a route to NAT for outbound) and database servers (no route to NAT). Option A is wrong because it gives database servers a route to NAT. Option B is wrong because it places web servers in public subnets with direct internet access, which is less secure.

Option C is wrong because it places database servers in public subnets.

Option B is correct because AWS Config rules can automatically remediate noncompliant resources using SSM Automation documents or Lambda functions. Option A is wrong because SCPs only enforce preventive controls, not auto-remediation. Option C is wrong because GuardDuty is a threat detection service, not for compliance automation.

Option D is wrong because IAM Access Analyzer analyzes resource policies for unintended access, not for enforcing best practices.

Options A and C are correct. S3 Block Public Access prevents public access, and IAM policies control access at the user/role level. Option B is incorrect because encryption does not prevent access; it protects data if accessed.

Option D is incorrect because MFA Delete is for deletion protection, not access control. Option E is incorrect because Versioning does not control access.

Options B and D are correct because they are the specific actions needed. Option A is for writing to SQS, not reading. Option C is too broad for CloudWatch Logs.

Option E is for deleting logs, which is not needed.

Option A is correct because it grants the CloudTrail service principal the necessary decrypt permission. Option B is wrong because the root user is not the CloudTrail service. Option C is wrong because it grants decrypt to all principals, which is too permissive.

Option D is wrong because the CMK key policy, not bucket policy, controls KMS permissions.

Option A is correct. The Lambda execution role does not include permissions to publish to SNS. The function can only perform actions that are allowed by the role.

Option B is wrong because the SQS trigger does not affect the function's ability to call SNS. Option C is wrong because the SQS policy is not relevant to SNS. Option D is wrong because the SNS topic policy may not exist or may not deny; the error is due to missing IAM permissions.

Option B is correct because the condition key `aws:RequestedRegion` checks the region endpoint used, but if the user is using a global endpoint or the request includes a different region parameter, it may fail. Option A is wrong because even if the instance type is not supported, the error would be different. Option C is wrong because service-linked roles do not affect RunInstances authorization.

Option D is wrong because the user already has a policy; an additional policy is not needed.

Option A is correct because the VPC might have a resource-based policy or a network ACL (though IAM is more common) that restricts actions. However, a more precise answer is that the user may not have permissions to use the subnet or security group. Option B is wrong because the user has full access.

Option C is wrong because the user has full access. Option D is wrong because the key pair is not an IAM resource.

Options A and C are correct because CloudWatch Logs can stream logs to Amazon OpenSearch Service for analysis, and CloudWatch Logs can also be used with subscription filters to invoke a Lambda function for real-time processing. Option B is wrong because Amazon Athena is for querying data in S3, not real-time streaming. Option D is wrong because Kinesis Data Analytics is for streaming data but requires a Kinesis stream; it is not directly integrated with CloudWatch Logs as a destination.

Option E is wrong because AWS Glue is a batch ETL service, not for real-time.

Option B is correct because the bucket policy denies PutObject if the encryption is not SSE-KMS. If the upload does not specify encryption, the encryption header is not set, so the condition StringNotEquals evaluates to true (since no encryption is not equal to 'aws:kms'), and the upload is denied. Option A is wrong because default encryption is not enabled.

Option C is wrong because SSE-S3 is also denied. Option D is wrong because the policy does not allow unencrypted uploads.

The correct options are B and D. A Service Control Policy can deny actions if MFA is not present, and an IAM policy with a condition for 'aws:MultiFactorAuthPresent' can be attached to users or groups. Option A is not effective because password policy does not enforce MFA usage.

Option C is about requiring MFA for API calls, but not enforcement. Option E is about roles, not users.

Option B is correct because it allows the user to manage their own access keys. Option A is wrong because it grants full IAM access. Option C is wrong because it does not allow deleting or creating keys.

Option D is wrong because it requires a specific resource ARN with a wildcard, which is not necessary for self-management.

Option B is correct because ECR requires authentication via 'ecr:GetAuthorizationToken' which is not included in the PowerUser policy. Option A is wrong because the error is not about resource policy. Option C is wrong because the error is access denied, not unsupported media type.

Option D is wrong because the error is not about image size.

Option B is correct because an IAM instance profile is the recommended way to grant permissions to EC2 instances. Option A is wrong because storing credentials in the code is insecure. Option C is wrong because storing credentials in an encrypted file still requires managing keys.

Option D is wrong because S3 bucket policies are not designed to grant permissions to EC2 instances directly.

Option C is correct because using the ALB's security group as the source in the instance security group ensures traffic only from the ALB. Option A is wrong because using the VPC CIDR would allow traffic from any resource in the VPC. Option B is wrong because using the subnet CIDR would allow traffic from any instance in that subnet.

Option D is wrong because using a network ACL would affect all instances in the subnet and cannot differentiate by source.

Options A and B are correct. The database security group should allow inbound MySQL from the bastion security group. The bastion security group should allow inbound SSH from a limited IP range (e.g., corporate IP).

Option C is wrong because allowing SSH from 0.0.0.0/0 is insecure. Option D is wrong because allowing MySQL from the public subnet CIDR would allow any instance in that subnet. Option E is wrong because allowing MySQL from 0.0.0.0/0 is insecure.

aws:RequestTag is used to enforce tags at creation. Option B is for existing tags. Option C is for EC2-specific resource tags.

Option D is for source IP.

Option D is correct because the trust policy in Account A allows Account B to assume the role, and users in Account B need permissions to call sts:AssumeRole. Option A is wrong because a resource-based policy on the role is not used. Option B is wrong because permission boundary is optional.

Option C is wrong because an SCP in Account B might deny the action.

Option D is correct because the Deny statement applies when encryption is not AES256, and SSE-KMS is not AES256. The Allow statement allows only AES256. Since SSE-KMS does not match, the Deny overrides.

Option A is wrong because the Deny statement denies. Option B is wrong because the Allow only allows AES256. Option C is wrong because the Deny is explicit.

Option B is correct because the key policy controls access to the KMS key. Even with full admin permissions in IAM, if the key policy does not grant the user decrypt permission, the request fails. Option A is wrong because the ciphertext is not malformed; the encryption succeeded.

Option C is wrong because IAM permissions are not enough; key policy must allow. Option D is wrong because the error is about decrypt, not about key existence.

Option C is correct because the condition restricts access to IPs in 10.0.0.0/16, and 10.1.0.5 is not in that range. Option A is wrong because the condition is not satisfied. Option B is wrong because there is no explicit deny.

Option D is wrong because the policy is valid.

Option B is correct because a Service Control Policy (SCP) can deny all actions if a condition for MFA is not met, effectively enforcing MFA across all accounts. Option A is wrong because an SCP cannot attach IAM policies to users; it only sets permission boundaries. Option C is wrong because IAM policies in each account would require manual management and may not be enforced consistently.

Option D is wrong because AWS Config rules can detect non-compliance but cannot enforce MFA at the time of access.

Option A is correct because using an IAM role with an instance profile is the recommended method to grant EC2 instances temporary credentials. Option B is incorrect because storing access keys on the instance is insecure. Option C is incorrect because S3 pre-signed URLs are for granting temporary access to specific objects, not for general instance access.

Option D is incorrect because EC2 does not support KMS key-based direct access to S3.

Option C is correct because the policy allows ec2:DescribeInstances, ec2:StartInstances, and ec2:StopInstances actions. The resource is '*', so all EC2 instances in the account are affected. Option A is wrong because the actions are not S3.

Option B is wrong because the policy allows start and stop. Option D is wrong because the principal is a role, not all users.

Option B is correct. For API Gateway IAM authorization, the resource ARN must include the stage and method, or use wildcards. The policy uses 'api-id/*' which may not match the actual resource path.

Option A is wrong because the condition is correct for IP restriction. Option C is wrong because the policy is attached to the group, so the developers should inherit it. Option D is wrong because API Gateway IAM authorization works with IAM policies; the issue is likely the resource ARN.

The best approach is to use S3 bucket policies with conditions that require the user to assume a specific IAM role in the bucket owner account. Option D is correct because it centralizes permissions and uses temporary credentials. Option A is wrong because it grants list access to all authenticated users.

Option B is wrong because resource-based policies (bucket policies) are better for cross-account. Option C is wrong because it allows full access to the whole organization.

Option B is correct because AWS Firewall Manager allows centralized management of security group rules across accounts and resources. Option A is wrong because AWS Config can evaluate compliance but not enforce rules. Option C is wrong because Service Control Policies (SCPs) control permissions at the account level, not network rules.

Option D is wrong because AWS Network Firewall is for network traffic inspection, not security group management.

Option A is correct because AWS Config rules can evaluate resources and trigger remediation via Lambda. Option B is wrong because CloudTrail logs API calls but does not trigger remediation. Option C is wrong because GuardDuty is for threat detection.

Option D is wrong because Systems Manager is for management, not compliance.

The correct options are A, C, and E. Access keys, IAM roles (via STS), and SAML federation are valid authentication methods. Option B, SSH keys, are for EC2 instance access, not AWS APIs.

Option D, client certificates, are not used for AWS API authentication.

Option C is correct because CloudTrail events are delivered within about 15 minutes of the API call. The command looks for events in the past, so delivery time is not an issue. However, the most common reason for missing events is that the command is run in a different region than where the event occurred, or the trail is not logging management events.

Option A is wrong because CloudTrail logs management events by default. Option B is wrong because key pair creation is a management event. Option D is wrong because events are delivered quickly.

Using a VPC endpoint for KMS and a key policy that restricts usage to the VPC endpoint prevents public internet access. Option A is wrong because it does not restrict usage to VPC. Option B is wrong because an SCP cannot restrict KMS key usage to a specific VPC.

Option D is wrong because CloudTrail does not enforce access restrictions.

To block SSH from the internet, you should remove the inbound rule that allows SSH from 0.0.0.0/0. You could also modify the source IP range to a specific range, but the simplest is to remove the rule. Adding a deny rule is not possible in security groups; they are allow-only.

Changing the network ACL would affect the entire subnet. Removing the public IP would also block HTTP, which is not desired.

Option B is correct. The condition requires the encryption context to be department=finance, but the object was encrypted with department=hr, so the decryption fails. Option A is wrong because the condition is not satisfied.

Option C is wrong because the user does not have kms:DescribeKey permission. Option D is wrong because the condition is not about the key policy.

Option D is correct because cross-account access requires both the resource-based policy (bucket policy) and the identity-based policy (on the auditor's IAM user/role) to allow the action. Option A is wrong because the bucket policy already allows the account. Option B is wrong because SCPs are for the auditor's account, not the resource account.

Option C is wrong because the trust policy is for assuming the role, not for S3 access.

Option D is correct because IAM Access Analyzer provides policy validation and can help identify unintended access. Option A shows effective permissions but doesn't necessarily trace sources. Option B is for analyzing service roles, not user permissions.

Option C is for CloudTrail analysis.

Option A is correct because VPC Gateway Endpoint for DynamoDB allows private connectivity. Option B is wrong because VPC Peering is for VPC-to-VPC. Option C is wrong because NAT Gateway is for internet access.

Option D is wrong because ClassicLink is for EC2-Classic, deprecated.

Option A is correct because Redshift automatically encrypts snapshots if the cluster is encrypted. Option C is correct because to share snapshots cross-account, the KMS key must allow the target account to decrypt. Option D is correct because Redshift uses a snapshot copy grant to authorize the destination account to use the key.

Option B is wrong because separate key is not required; same key can be used if permissions allow. Option E is wrong because AWS Config rule doesn't enforce cross-account sharing security.

Option C is correct because implementing a host-based firewall (e.g., AWS Systems Manager Agent with a firewall policy) on each EC2 instance can restrict outbound connections from the application to only necessary destinations, preventing lateral movement. Option A (network ACLs) can block traffic at the subnet level but are not as granular for individual instances. Option B (VPC peering) is not relevant.

Option D (AWS WAF) protects against web exploits but does not prevent lateral movement after compromise.

AWS CloudTrail logs all API calls, including RunInstances, capturing the user or role that launched the instance. Option A (VPC Flow Logs) shows IP traffic but not user identity. Option C (AWS Config) shows resource configuration but not who launched it.

Option D (IAM Access Analyzer) analyzes policies.

Option A is correct because AWS Config can detect non-compliant resources and trigger Lambda functions for remediation. Option B is wrong because Security Hub provides findings but does not automatically remediate. Option C is wrong because CloudTrail logs events but does not evaluate compliance.

Option D is wrong because GuardDuty provides threat detection but not configuration compliance.

CloudTrail logs API calls, and CloudWatch Events (now Amazon EventBridge) can trigger automated responses. Option C is correct. Option A (Config + Lambda) is for configuration compliance.

Option B (GuardDuty + SNS) is for threat detection alerting. Option D (Inspector + S3) is for vulnerability assessment.

Correct options: B (GuardDuty) and C (IAM Access Analyzer). GuardDuty can detect unusual login locations. IAM Access Analyzer helps identify external access.

Option A is wrong because CloudTrail is a logging service, not a detection service. Option D is wrong because Config is for resource configuration. Option E is wrong because CloudWatch Logs alone does not detect anomalies.

CloudTrail logs API calls. To ensure immutability, S3 Object Lock prevents deletion or overwriting. MFA delete adds protection.

Config does not prevent log tampering. KMS encrypts but does not prevent deletion.

Option A is correct: a password policy enforces complexity. Option D is correct: MFA adds an extra layer of security. Option B is wrong: access keys should not be shared.

Option C is wrong: root user should be avoided for daily tasks. Option E is wrong: deleting users is not a best practice; deactivating is better.

Options A and D are correct. The EC2 instance needs an IAM role with permissions to write to the bucket (A), and the bucket policy must allow the role to write (D). Option B is wrong because CloudTrail is for API logging, not application logs.

Option C is wrong because the VPC endpoint is for private connectivity, not required. Option E is wrong because a security group does not grant IAM permissions.

Option B (IPsec VPN over Direct Connect) is correct because it encrypts the traffic over the private VIF. Option A is wrong because Direct Connect itself does not encrypt. Option C is wrong because using a VPN over the internet is less secure and not over Direct Connect.

Option D is wrong because TLS is for application layer, not network layer.

Option B is correct because Amazon GuardDuty uses threat intelligence to detect suspicious activity, including unauthorized S3 access attempts. Option A is wrong because AWS CloudTrail is for logging, not real-time detection. Option C is wrong because Amazon Macie is for data classification.

Option D is wrong because AWS Config is for compliance.

Option A is correct because AWS Config has managed rules like 's3-bucket-public-read-prohibited' that can evaluate S3 bucket policies and ACLs. Option B is wrong because AWS CloudTrail records API calls but does not evaluate resource configurations. Option C is wrong because Amazon GuardDuty focuses on threat detection.

Option D is wrong because AWS Trusted Advisor provides best-practice checks but not continuous monitoring and alerting.

Option D is correct because Amazon CloudWatch Logs subscription filter can send logs to Lambda for transformation, but not route to multiple destinations easily. Option A is correct because Amazon Kinesis Data Streams can ingest logs and then use Kinesis Data Analytics for transformation and Kinesis Data Firehose for routing to multiple destinations. Option B is incorrect because S3 is a storage destination, not a processing and routing service.

Option C is incorrect because CloudWatch Logs Insights is for querying, not real-time routing.

AWS Shield Advanced (A) provides DDoS protection, and using AWS WAF (B) helps filter malicious traffic. Option A and B are correct. Security groups (C) are stateful firewalls, not DDoS protection.

NACLs (D) are stateless firewalls. VPC peering (E) is for connectivity.

Option D is correct because S3 Bucket Policies can be used to deny uploads of unencrypted objects. Option A is incorrect because S3 Block Public Access does not enforce encryption. Option B is incorrect because S3 Inventory only provides metadata, not enforcement.

Option C is incorrect because S3 Object Lock is for retention, not encryption.

Option D is correct because AWS Control Tower provides a managed service to set up a multi-account environment with guardrails. Option A is wrong because AWS Config is for compliance, not policy enforcement. Option B is wrong because IAM Policy Simulator is for testing.

Option C is wrong because AWS Shield is for DDoS protection.