AWS Certified Security Specialty SCS-C02 SCS-C02 Questions 151–225 | Page 3/6

151

Multi-Selectmedium

A security engineer is designing a VPC with public and private subnets. The private subnets will host databases that should not have direct internet access. Which three components are required to provide outbound internet access for these databases? (Choose THREE.)

Select 3 answers

A.AWS WAF attached to the NAT gateway.

B.An internet gateway attached to the VPC.

C.Route tables in the private subnets with a default route (0.0.0.0/0) pointing to the NAT gateway.

D.A VPC gateway endpoint for S3.

E.A NAT gateway in a public subnet.

AnswersB, C, E

The internet gateway provides internet access for the public subnet where the NAT gateway resides.

Why this answer

An internet gateway (IGW) is required to enable outbound internet access for resources in a VPC. The NAT gateway, which resides in a public subnet, uses the IGW to translate private IP addresses to the public IP of the NAT gateway, allowing instances in private subnets to initiate outbound traffic to the internet while preventing inbound connections from the internet.

Exam trap

The trap here is that candidates often think a NAT gateway alone provides internet access, forgetting that the NAT gateway must be placed in a public subnet with a route to an internet gateway, and that the private subnet’s default route must point to the NAT gateway, not the IGW.

Full explanation →

152

MCQeasy

A company uses Amazon GuardDuty and receives a finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. What does this finding indicate?

A.The instance is being targeted by an SSH brute force attack.

B.The instance is communicating with a known command and control server.

C.The instance is exfiltrating data to an S3 bucket.

D.The instance is being used in a DDoS attack.

AnswerB

The finding name indicates C&C activity detected via DNS.

Why this answer

The finding 'Backdoor:EC2/C&CActivity.B!DNS' indicates that GuardDuty has detected DNS queries from the EC2 instance to a domain associated with known command and control (C&C) infrastructure. This is based on GuardDuty's threat intelligence feeds that map DNS request patterns to known malicious domains, signaling that the instance may be compromised and communicating with an attacker's server.

Exam trap

The trap here is that candidates may confuse 'Backdoor:EC2/C&CActivity.B!DNS' with generic network anomalies or other attack types, but the key differentiator is the DNS-specific indicator that pinpoints communication with a known command and control server, not the attack vector or data exfiltration method.

How to eliminate wrong answers

Option A is wrong because SSH brute force attacks are detected by GuardDuty findings such as 'UnauthorizedAccess:EC2/SSHBruteForce', not by DNS-based C&C activity. Option C is wrong because data exfiltration to an S3 bucket would typically be detected by findings like 'Policy:IAMUser/RootCredentialUsage' or S3-specific findings, not by DNS query analysis for C&C domains. Option D is wrong because DDoS attack participation is indicated by findings such as 'Backdoor:EC2/DenialOfService' or 'Behavior:EC2/NetworkOutboundDenialOfService', which analyze traffic volume and patterns, not DNS queries to C&C servers.

Full explanation →

153

MCQhard

Refer to the exhibit. A security engineer runs the AWS CLI command shown and receives an AccessDenied error. The IAM user Alice has a policy that grants kms:Decrypt on all resources. What is the most likely cause of the error?

A.The KMS key policy does not grant kms:Decrypt to the IAM user Alice.

B.The IAM user policy does not allow kms:Decrypt.

C.The command uses the wrong key ID.

D.The ciphertext blob is corrupted.

AnswerA

KMS requires both IAM policy and key policy to grant access; key policy may deny.

Why this answer

The AccessDenied error is caused by the KMS key policy, which explicitly restricts which principals can decrypt using the key. Even though Alice's IAM policy allows kms:Decrypt on all resources, the key policy must also grant her access. If the key policy does not list Alice (or her role) as a principal allowed to decrypt, the request fails.

Option A correctly identifies this as the most likely cause.

Full explanation →

154

Multi-Selectmedium

A company is designing a secure data sharing solution with a third party. The company needs to share sensitive files stored in an S3 bucket with the third party, ensuring that the files are encrypted at rest and in transit, and that the third party can only access specific files. The company also wants to rotate the access credentials every 30 days. Which TWO actions should the company take? (Select TWO.)

Select 2 answers

A.Create an IAM role in the company's account that the third party can assume, and attach a policy that grants access to the specific files.

B.Use S3 Cross-Region Replication to replicate the files to a bucket in the third party's account.

C.Configure an S3 bucket policy that denies access unless the request includes a specific KMS key ID.

D.Generate presigned URLs for the specific files and email them to the third party.

E.Use a KMS key policy that grants the third party's AWS account permission to use the key for decrypt operations.

AnswersC, E

Enforces that only objects encrypted with the specified key can be accessed.

Why this answer

Options C and E are correct. Option C uses an S3 bucket policy with a condition requiring requests to include a specific KMS key ID, ensuring that only requests using that key can access the objects. This enforces encryption at rest (objects encrypted with that key) and in transit (HTTPS with KMS).

Option E grants the third party's AWS account permission to use that KMS key for decrypt operations, allowing them to decrypt the files. Together, they provide encryption key control and the ability to rotate the key or its policy every 30 days. Option A (cross-account IAM role) does not enforce encryption key control and requires the third party to assume a role, but credential rotation is managed via role trust policy, not directly.

Option B (S3 Cross-Region Replication) replicates objects but does not enforce key-specific access or encryption at rest in the destination. Option D (presigned URLs) provides time-limited access but does not enforce encryption key control and cannot be easily rotated every 30 days without regenerating URLs.

Full explanation →

155

MCQmedium

A company is using AWS Organizations with multiple accounts. The security team needs to centrally monitor all root user API activity across all accounts and receive alerts within minutes. What is the MOST efficient solution?

A.Create an organization trail in CloudTrail that logs all accounts. Use CloudWatch Logs metric filters and alarms to detect root login events.

B.Enable CloudTrail in each account and aggregate logs to a centralized S3 bucket. Use Athena queries to detect root activity and send alerts via SNS.

C.Use AWS Lambda functions in each account to poll CloudTrail logs and send root activity to a central SQS queue.

D.Enable AWS Config rules in each account to detect root user activity and send notifications to a central SNS topic.

AnswerA

An organization trail logs all accounts centrally. CloudWatch Logs metric filters can detect root activity and trigger alarms in near real-time.

Why this answer

An organization trail in AWS CloudTrail logs API activity for all accounts in AWS Organizations from a single point, eliminating the need to manage per-account trails. By sending these logs to CloudWatch Logs, you can create metric filters to detect root user login events (e.g., the 'RootLogin' event) and configure CloudWatch Alarms to trigger SNS notifications within minutes, meeting the requirement for centralized monitoring and rapid alerts.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing per-account setups (B, C, D) instead of leveraging the native AWS Organizations integration with CloudTrail, which provides a single, centralized trail for all accounts.

How to eliminate wrong answers

Option B is wrong because while aggregating logs to a centralized S3 bucket is possible, using Athena queries to detect root activity is not efficient for real-time alerts within minutes; Athena is designed for ad-hoc querying of historical data, not for streaming or low-latency alerting. Option C is wrong because using Lambda functions in each account to poll CloudTrail logs introduces unnecessary complexity, latency, and cost; CloudTrail can deliver logs directly to CloudWatch Logs without polling, and a centralized solution is more efficient. Option D is wrong because AWS Config rules are designed for evaluating resource configurations against desired policies, not for monitoring API activity like root user logins; Config does not natively capture CloudTrail events and cannot provide real-time alerts for root API activity.

Full explanation →

156

MCQhard

A security engineer is reviewing the following IAM policy attached to an S3 bucket: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*", "Condition": { "IpAddress": { "aws:SourceIp": "10.0.0.0/8" } } } ] } The bucket contains sensitive data and should only be accessible from the corporate network (CIDR 10.0.0.0/8). However, the engineer is concerned that this policy might not be effective. What is the primary security concern with this policy?

A.The bucket policy does not include a Deny statement for requests outside the IP range, so the default allow might still permit access from other IPs.

B.The policy grants public access to the bucket because the Principal is "*", allowing anyone from the specified IP range to access objects.

C.The condition key aws:SourceIp only evaluates the IP address of the client, but if the request comes through a proxy, the IP might not match.

D.The policy uses s3:GetObject but does not include s3:ListBucket, so users cannot see the object list, but they can guess object keys.

AnswerB

The policy sets Principal to '*' in a bucket policy, which means every principal—including unauthenticated anonymous users—is included in the scope of the statement. The condition on aws:SourceIp narrows the network source to a specific IP CIDR, but it does not require any AWS credentials, identity, or account relationship. As a result, any person or service whose traffic originates from that IP range can read objects in the bucket, making the bucket effectively public to that entire network.

Why this answer

The bucket policy uses `"Principal": "*"` combined with `"Effect": "Allow"`, which explicitly grants public access to anyone who meets the condition. While the condition restricts access to the `10.0.0.0/8` IP range, the policy itself is still a public bucket policy — it allows any authenticated or unauthenticated user from that IP range to read objects. This violates the principle of least privilege and exposes sensitive data to any user on the corporate network, not just authorized IAM roles or users.

Exam trap

The trap here is that candidates focus on the IP restriction condition and assume it makes the policy secure, overlooking the fact that `"Principal": "*"` still makes the bucket publicly accessible to any user within that IP range, which is a direct violation of AWS shared responsibility and least privilege principles.

How to eliminate wrong answers

Option A is wrong because the default behavior of IAM and S3 bucket policies is to deny all access unless explicitly allowed; there is no 'default allow' that would permit requests outside the IP range — the policy simply does not grant access to IPs outside `10.0.0.0/8`, so they are implicitly denied. Option C is wrong because the `aws:SourceIp` condition key correctly evaluates the source IP of the request, and while proxies can alter the perceived IP, the condition still works as intended for direct requests; the concern about proxy IPs is a valid operational consideration but not the primary security flaw of this policy. Option D is wrong because the lack of `s3:ListBucket` does not create a security vulnerability — it only prevents listing objects, which is a separate access control concern, and the policy's primary issue is granting public access to sensitive data.

Full explanation →

157

MCQhard

A company uses AWS CloudTrail to log all API activity and delivers logs to an S3 bucket with server-side encryption (SSE-S3). The security team needs to ensure that only authorized personnel can access the logs and that any unauthorized access attempts are logged and alerted. Additionally, the team wants to prevent the logs from being deleted for at least one year. Which combination of actions should be taken?

A.Enable S3 Object Lock with a retention period of one year; enable S3 server access logs; use a bucket policy with a condition that allows access only from authorized IAM roles or users.

B.Enable S3 default encryption (SSE-S3) on the bucket; enable S3 server access logs; attach an IAM policy that allows only authorized users to access the bucket.

C.Enable MFA Delete on the bucket; enable CloudTrail log file validation; use bucket ACLs to restrict access.

D.Enable S3 Inventory to track objects; enable CloudTrail to log S3 API calls; use a bucket policy with a deny effect for unauthorized users.

AnswerA

Object Lock prevents deletion; server access logs record all requests; bucket policy with conditions restricts access.

Why this answer

S3 Object Lock with a retention period of one year enforces a write-once-read-many (WORM) model, preventing any deletion or overwrite of log objects for that duration. S3 server access logs capture detailed records of all requests made to the bucket, including unauthorized access attempts, which can be used for alerting. The bucket policy with a condition restricting access to authorized IAM roles or users ensures that only permitted principals can access the logs, meeting the security team's requirements for access control, logging of unauthorized attempts, and deletion prevention.

Exam trap

The trap here is that candidates often confuse S3 default encryption with data retention controls, or assume that CloudTrail logging of S3 API calls is sufficient to capture unauthorized access attempts, when in fact S3 server access logs are needed for request-level logging of denied operations.

How to eliminate wrong answers

Option B is wrong because enabling S3 default encryption (SSE-S3) only encrypts data at rest but does not prevent deletion of logs; it lacks a retention mechanism like Object Lock. Option C is wrong because MFA Delete protects against accidental deletion but does not enforce a minimum retention period (it can be bypassed by an authorized user with MFA), and bucket ACLs are deprecated and less granular than bucket policies for access control. Option D is wrong because S3 Inventory only provides a list of objects and their metadata, not real-time logging of access attempts; CloudTrail logs S3 API calls but does not log unauthorized access attempts at the S3 request level (e.g., denied GET requests), and a bucket policy with a deny effect for unauthorized users does not inherently log those attempts or prevent deletion.

Full explanation →

158

MCQeasy

A company wants to restrict access to an S3 bucket so that only traffic from a specific VPC can read objects. Which security mechanism should be used?

A.Use an S3 bucket policy with a condition that restricts access to the VPC endpoint ID.

B.Assign an IAM role to the S3 bucket.

C.Attach a security group to the S3 bucket.

D.Configure a network ACL on the VPC subnet to allow traffic to S3.

AnswerA

A bucket policy can use the aws:SourceVpce condition key to restrict access to a specific VPC endpoint. This allows only traffic that arrives through the corresponding gateway or interface endpoint to reach the bucket, while all other sources, including the public internet, are denied. This resource-based control is the correct way to enforce VPC-only access to an S3 bucket.

Why this answer

An S3 bucket policy can include a condition that restricts access to traffic originating from a specific VPC endpoint. By using the `aws:SourceVpce` condition key, the policy ensures that only requests coming through the specified VPC endpoint (interface or gateway) are allowed to read objects, effectively locking down access to the VPC.

Exam trap

The trap here is that candidates often confuse network-level controls (security groups, NACLs) with resource-based policies, mistakenly thinking they can apply security groups or NACLs to S3 buckets, when in fact S3 only supports bucket policies and IAM policies for access control.

How to eliminate wrong answers

Option B is wrong because IAM roles are assigned to principals (users, services) to grant permissions, not to S3 buckets; buckets themselves cannot assume roles. Option C is wrong because security groups are network-level firewalls for EC2 instances and other AWS resources, but S3 buckets are not network interfaces and cannot have security groups attached. Option D is wrong because network ACLs control traffic at the subnet level and cannot restrict access to a specific S3 bucket; they also cannot enforce bucket-level conditions like VPC endpoint IDs.

Full explanation →

159

MCQeasy

A security team needs to detect unauthorized attempts to access an S3 bucket that contains sensitive data. Which AWS service can automatically analyze S3 access logs and generate findings for suspicious activity?

A.Amazon Macie

B.Amazon GuardDuty

C.AWS Trusted Advisor

D.Amazon Detective

AnswerB

GuardDuty analyzes S3 data events for suspicious activity.

Why this answer

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can analyze VPC Flow Logs, AWS CloudTrail event logs, and DNS logs, and when S3 access logging is enabled, GuardDuty can ingest those logs to detect suspicious S3 access patterns, such as anomalous data exfiltration or access from unusual geographies. GuardDuty then generates security findings that can be automated for remediation.

Exam trap

The trap here is that candidates often confuse Amazon Macie's data classification and sensitive data discovery capabilities with GuardDuty's threat detection, mistakenly thinking Macie can analyze access logs for unauthorized activity, when in fact Macie focuses on data content and access control policies, not real-time log-based threat detection.

How to eliminate wrong answers

Option A is wrong because Amazon Macie is a data security and data privacy service that uses machine learning to discover, classify, and protect sensitive data in S3, but it does not automatically analyze S3 access logs for unauthorized access attempts or generate findings for suspicious activity; it focuses on data classification and access control monitoring via its own findings, not log-based threat detection. Option C is wrong because AWS Trusted Advisor is an advisory service that inspects your AWS environment and makes recommendations for cost optimization, performance, security, and fault tolerance, but it does not perform real-time log analysis or generate findings for suspicious S3 access activity. Option D is wrong because Amazon Detective is a security investigation service that helps analyze and visualize security data to identify the root cause of findings, but it does not automatically analyze S3 access logs to generate findings for suspicious activity; it relies on existing findings from services like GuardDuty to perform its analysis.

Full explanation →

160

MCQhard

A company uses AWS Organizations to manage multiple accounts. The security team needs to implement a centralized logging solution where all VPC Flow Logs from all accounts are sent to a central S3 bucket in the security account. The flow logs must be encrypted with a customer-managed KMS key (CMK) that is owned by the security account. The security engineer has enabled VPC Flow Logs in each account and configured the destination to be the central S3 bucket. However, the flow logs are not being delivered. The engineer checks the S3 bucket policy and confirms that it grants the required permissions to the Flow Logs service principal. What is the MOST likely cause of the failure?

A.The VPC Flow Logs service does not support cross-account delivery.

B.The KMS key policy does not grant the Flow Logs service principal permission to use the key.

C.CloudTrail must be enabled in the source account for Flow Logs to work.

D.The S3 bucket policy is missing a condition for source account.

AnswerB

The key policy must allow the service principal to encrypt.

Why this answer

The KMS key policy must grant the VPC Flow Logs service principal (flow-logs.amazonaws.com) permission to use the customer-managed key for encryption. The engineer verified the S3 bucket policy, so the missing KMS key policy is the most likely cause. Option A is incorrect because VPC Flow Logs can deliver to cross-account S3 buckets.

Option C is incorrect because CloudTrail is not required for Flow Logs. Option D is incorrect because the S3 bucket policy already grants permissions to the Flow Logs service principal.

Full explanation →

161

MCQhard

A financial services company runs a critical application on Amazon EC2 instances in a VPC. The application processes sensitive financial data and must meet strict compliance requirements. The security team recently discovered that an EC2 instance was compromised due to an unpatched vulnerability. The attacker used the instance's IAM role to access an S3 bucket containing customer data and exfiltrated the data. The security team needs to prevent such incidents in the future. They have implemented the following controls: - All EC2 instances are launched in private subnets. - The IAM roles used by EC2 instances follow the principle of least privilege. - Security groups restrict inbound and outbound traffic. - AWS Systems Manager Patch Manager is used to patch instances. - AWS CloudTrail is enabled and logs are sent to a centralized S3 bucket. - Amazon GuardDuty is enabled. Despite these controls, the team is concerned about the blast radius if an instance is compromised again. Which additional measure would MOST effectively limit the blast radius of a compromised EC2 instance?

A.Enable VPC Flow Logs to monitor traffic to S3.

B.Use S3 VPC Endpoints with a bucket policy that only allows access from the VPC endpoint, and use Systems Manager Session Manager instead of SSH.

C.Deploy AWS WAF in front of the S3 bucket.

D.Create an AWS Config rule to detect S3 access from EC2 instances.

AnswerB

Creating an S3 VPC endpoint and attaching a bucket policy that denies all access unless the request originates from that endpoint confines S3 traffic to the AWS internal network, removing exposure to the public internet. This, combined with replacing SSH with AWS Systems Manager Session Manager, eliminates inbound SSH ports and relies on IAM-based, auditable session access instead of static keys. Together, these controls shrink the attack surface and provide preventive, policy-enforced protection against both network-level exfiltration and credential compromise.

Why this answer

Using an S3 VPC endpoint with a bucket policy that restricts access exclusively to that endpoint ensures that compromised EC2 instances can only reach S3 through the VPC endpoint, preventing data exfiltration over the internet. Additionally, replacing SSH with Systems Manager Session Manager eliminates the need for open inbound SSH ports and provides fine-grained access control through IAM, reducing the attack surface and blast radius.

Exam trap

The trap here is that candidates may choose VPC Flow Logs (Option A) thinking it provides active protection, but it is only a monitoring tool that does not reduce the blast radius; the key is to implement network-level and access-level restrictions that prevent data exfiltration even if an instance is compromised.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs only provide visibility into traffic patterns and do not actively limit the blast radius or prevent data exfiltration. Option C is wrong because AWS WAF is a web application firewall designed to protect web-facing resources like ALB or CloudFront, not S3 buckets directly; it cannot restrict access from EC2 instances to S3. Option D is wrong because an AWS Config rule is a detective control that can detect non-compliant access after it occurs, but it does not proactively limit the blast radius or prevent exfiltration in real time.

Full explanation →

162

MCQeasy

A security engineer needs to centralize logs from multiple AWS accounts into a single S3 bucket. Which solution is most secure?

A.Deliver logs to separate buckets per account and use S3 replication to copy them to a central bucket.

B.Use a single S3 bucket in the management account and have each account write logs directly without additional permissions.

C.Configure each account's CloudTrail to deliver to a centralized S3 bucket in a logging account, with a bucket policy allowing CloudTrail from source accounts.

D.Stream logs to Amazon Kinesis Data Firehose in each account and consolidate into a single S3 bucket via cross-account delivery.

AnswerC

This is correct because CloudTrail can be configured as a single trail (or one per source account) to deliver to a centralized S3 bucket in a dedicated logging account. The logging account's S3 bucket policy must explicitly authorize cloudtrail.amazonaws.com for each source account, usually with a source account and source ARN condition, so CloudTrail can write objects to a per-source prefix. This creates an immutable, central log store that source-account administrators cannot modify or delete, and it is a standard, well-supported pattern for centralized logging.

Why this answer

It uses a centralized S3 bucket in a dedicated logging account with a bucket policy that explicitly grants CloudTrail from source accounts the s3:PutObject permission. This ensures logs are written directly to a single location without intermediate replication or cross-account delivery that could introduce latency or complexity. The bucket policy can restrict access to only CloudTrail service principals and specific source account ARNs, maintaining a secure, auditable log trail.

Exam trap

The trap here is that candidates assume S3 replication (Option A) is the simplest centralized solution, but they overlook that CloudTrail can deliver directly to a cross-account bucket with a properly scoped bucket policy, which is more secure and avoids the overhead of replication or streaming services.

How to eliminate wrong answers

Option A is wrong because S3 replication introduces a time delay and requires the source bucket to have versioning enabled, which adds complexity and potential for log loss if replication fails; it also duplicates storage costs and does not prevent the source account from modifying logs before replication. Option B is wrong because having each account write logs directly to a bucket in the management account without additional permissions is insecure—CloudTrail requires explicit cross-account permissions via a bucket policy, and without them, the write will fail; this option also violates the principle of least privilege by allowing all accounts to write to a single bucket without restriction. Option D is wrong because streaming logs through Kinesis Data Firehose introduces an additional service that can fail or throttle, adds latency, and requires managing cross-account delivery policies for Firehose, which is more complex and less secure than direct CloudTrail delivery to S3 with a bucket policy.

Full explanation →

163

MCQhard

Refer to the exhibit. A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to get and put objects in the S3 bucket 'example-bucket' only from the IP range 203.0.113.0/24. However, the user reports that they are unable to put objects from an IP within that range. What is the most likely cause of this issue?

A.The condition key should be 'aws:sourceIp' (lowercase 's').

B.The policy should use the 'NotIpAddress' condition operator instead of 'IpAddress'.

C.The resource ARN should be 'arn:aws:s3:::example-bucket' without the '/*' suffix.

D.The policy lacks a separate statement to allow 's3:ListBucket' on the bucket resource.

AnswerD

For console access, ListBucket is required; without it, the user cannot see the bucket but can still perform PutObject via API. However, the question implies inability to put objects, which could be due to missing ListBucket in some SDK scenarios.

Why this answer

The policy only grants s3:GetObject and s3:PutObject actions on the bucket's objects (arn:aws:s3:::example-bucket/*), but does not include a separate statement allowing s3:ListBucket on the bucket resource (arn:aws:s3:::example-bucket). Without s3:ListBucket, the user cannot list the bucket's contents, which is often required by the AWS CLI or SDK to resolve object keys before performing put operations. The IP condition is correctly applied, so the issue is the missing list permission.

Exam trap

The trap here is that candidates focus on the IP condition syntax or resource ARN format and overlook the common requirement for an explicit s3:ListBucket permission when performing object operations via the AWS CLI or SDK.

How to eliminate wrong answers

Option A is wrong because 'aws:sourceIp' is the correct case-sensitive condition key; AWS condition keys are case-sensitive and 'aws:sourceIp' is valid. Option B is wrong because using 'NotIpAddress' would deny access from the specified range and allow all others, which is the opposite of the intended effect. Option C is wrong because the resource ARN 'arn:aws:s3:::example-bucket/*' is correct for object-level actions (GetObject, PutObject); the bucket-level ARN without '/*' is used for bucket-level actions like ListBucket, not for object operations.

Full explanation →

164

Multi-Selecthard

A security engineer is designing a solution to automatically remediate noncompliant EC2 security groups. The company uses AWS Organizations with multiple accounts. The engineer wants to deploy an AWS Config rule and a custom Lambda function in a central security account to evaluate and remediate security groups across all accounts. Which combination of steps is REQUIRED to allow the Lambda function to modify security groups in member accounts? (Choose TWO.)

Select 2 answers

A.Create an IAM role in each member account that allows the central security account to assume it.

B.Use AWS CloudFormation StackSets to deploy the Lambda function to all member accounts.

C.Configure an AWS Config remediation action that invokes the Lambda function in the central account.

D.Attach a resource-based policy to the Lambda function granting access to Config from all member accounts.

E.Create the Lambda function in each member account and configure Config rules in each account.

AnswersA, C

This enables cross-account access for the Lambda function to modify security groups.

Why this answer

The correct approach is to use AWS Config aggregated rules with remediation actions that invoke Lambda cross-account. Option A is required to allow the central account to assume a role in member accounts; Option C is required to invoke the Lambda function from Config. Option B (same account) is not cross-account.

Option D is not required because Config aggregates can work with individual accounts. Option E is redundant.

Full explanation →

165

Multi-Selectmedium

A security engineer is designing a secure VPC architecture. Which THREE components should be used to implement defense in depth? (Choose three.)

Select 3 answers

A.VPN connection

B.Internet gateway

C.Security groups

D.Network ACLs

E.VPC Flow Logs

AnswersC, D, E

Instance-level firewall.

Why this answer

Security groups (C) are stateful virtual firewalls that control inbound and outbound traffic at the instance level. They operate at the network interface (ENI) level, allowing only explicitly permitted traffic and automatically allowing return traffic for permitted sessions. This provides a critical layer of host-level defense within the VPC.

Exam trap

The trap here is that candidates often confuse connectivity components (VPN, Internet gateway) with security controls, or they overlook that VPC Flow Logs are a detective control (not preventive) but still a valid part of defense in depth, leading them to select A or B instead of the correct trio of security groups, network ACLs, and VPC Flow Logs.

Full explanation →

166

Multi-Selecthard

A security engineer is designing a solution to detect and alert on any S3 bucket that is publicly accessible. Which THREE services can be used together to achieve this?

Select 3 answers

A.AWS Security Hub

B.Amazon S3 Block Public Access settings

C.AWS Config

D.AWS CloudTrail

E.Amazon VPC Flow Logs

AnswersA, C, D

Aggregates findings from Config and other services.

Why this answer

(AWS Security Hub) is correct because it can aggregate findings from other services like AWS Config and Amazon GuardDuty, providing a centralized view and alerting for S3 bucket public access issues. Option C (AWS Config) is correct because it can evaluate S3 bucket policies against a managed rule (e.g., s3-bucket-public-read-prohibited) to detect public access and trigger alerts. Option D (AWS CloudTrail) is correct because it logs S3 API calls such as PutBucketPolicy, and you can create CloudWatch Events or metric filters to alert on changes that grant public access.

Option B (Amazon S3 Block Public Access) is incorrect; it is a preventive control that blocks public access but does not detect or alert on existing public buckets. Option E (Amazon VPC Flow Logs) is incorrect because it captures network traffic data, not S3 bucket policy changes.

Full explanation →

167

MCQhard

A security engineer applies the bucket policy shown in the exhibit to an S3 bucket. What is the effect of this policy?

A.Allows uploads only if they use SSE-S3.

B.Allows uploads without encryption.

C.Allows uploads with any server-side encryption.

D.Allows uploads only if they use SSE-KMS.

AnswerD

Correct because the policy allows uploads only when the request specifies SSE-KMS.

Why this answer

The bucket policy includes a Deny statement that restricts uploads based on encryption headers. Specifically, it denies requests where the x-amz-server-side-encryption header is not set to 'aws:kms' or where the x-amz-server-side-encryption-aws-kms-key-id is missing. This effectively allows only uploads that use SSE-KMS.

Therefore, Option D is correct.

Full explanation →

168

MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to centralize security logs (CloudTrail, VPC Flow Logs, AWS Config) from all accounts into a single S3 bucket for analysis. What is the MOST secure way to set up this centralized logging?

A.Create a dedicated S3 bucket in the management account, enable S3 default encryption, and configure service delivery for each account.

B.Create a dedicated S3 bucket in the security account with a bucket policy that grants write access to the logging services of all accounts and enforces encryption in transit and at rest.

C.Configure each account to deliver logs to the same S3 bucket used for other data.

D.Create an S3 bucket in each account and use S3 replication to copy logs to a central bucket.

AnswerB

This approach aligns with AWS best practices by placing logs in a dedicated security account that is isolated from production workloads and the management account. The bucket policy grants write access only to the logging services of all accounts, using service principals like logging.s3.amazonaws.com, while condition keys such as aws:SecureTransport force TLS and a deny statement without s3:x-amz-server-side-encryption ensures all objects are encrypted at rest. This centralizes auditability, enforces least privilege, and provides a single source of truth for compliance and incident investigation.

Why this answer

It uses a dedicated S3 bucket in a security account (not the management account) with a bucket policy that explicitly grants write access to the logging services (CloudTrail, VPC Flow Logs, AWS Config) from all accounts, while enforcing encryption in transit (aws:SecureTransport) and at rest (default SSE-S3 or SSE-KMS). This follows the security best practice of isolating logs in a separate account and using resource-based policies to restrict access, preventing accidental deletion or modification by other accounts.

Exam trap

The trap here is that candidates often assume the management account is the safest place for centralized logs, but AWS best practices recommend using a dedicated security account to isolate logs and avoid compromising the management account's administrative boundaries.

How to eliminate wrong answers

Option A is wrong because placing the S3 bucket in the management account violates the principle of least privilege and separation of duties; the management account should not be used for operational workloads, and service delivery configuration alone does not enforce encryption in transit or restrict access to only logging services. Option C is wrong because using the same S3 bucket for other data increases the attack surface and risk of unauthorized access or log tampering, and it does not enforce encryption or proper access controls for logging services. Option D is wrong because S3 replication introduces complexity, potential latency, and does not enforce encryption in transit or at rest at the source; it also requires additional permissions and does not centralize logs directly from the logging services.

Full explanation →

169

MCQhard

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The security team uses Amazon GuardDuty and has enabled Amazon Detective. Recently, GuardDuty raised a 'Recon:EC2/PortProbeUnprotectedPort' finding for one of the instances. The security engineer verified that the ALB security group only allows inbound HTTP/HTTPS from the internet. However, the finding indicates that the instance is receiving probes on port 22 (SSH). Further investigation with Detective shows that the probes originate from multiple IP addresses and are reaching the instance's private IP address. The engineer suspects that the SSH port is exposed despite the security group configuration. What is the MOST likely cause of this exposure?

A.The EC2 instance's security group allows inbound SSH from 0.0.0.0/0.

B.VPC Flow Logs are misconfigured and are inadvertently forwarding traffic to the instance.

C.AWS Shield Advanced is causing false positives by marking legitimate traffic as probes.

D.The ALB security group has an inbound rule that allows SSH from the internet.

AnswerA

The EC2 instance's security group explicitly permits inbound SSH on port 22 from 0.0.0.0/0. This means the instance is reachable directly from the internet on its own public or elastic IP, completely bypassing the ALB. GuardDuty detects the resulting SSH brute-force attempts from external sources, so this is the root cause despite the ALB fronting web traffic.

Why this answer

The GuardDuty finding 'Recon:EC2/PortProbeUnprotectedPort' indicates that an EC2 instance is receiving unsolicited probes on a port that should not be publicly accessible. Since the ALB security group only allows HTTP/HTTPS from the internet, but the probes are reaching the instance's private IP on port 22 (SSH), the most likely cause is that the instance's own security group has an inbound rule allowing SSH from 0.0.0.0/0. This bypasses the ALB's security group because the instance's security group is evaluated independently for direct traffic to the instance's private IP, and if it permits SSH from anywhere, the probes will reach the instance.

Exam trap

The trap here is that candidates assume the ALB's security group fully protects the backend instances, forgetting that instances have their own security groups that are evaluated independently for direct traffic to their private IPs.

How to eliminate wrong answers

Option B is wrong because VPC Flow Logs are a monitoring feature that captures metadata about IP traffic; they do not forward or route traffic to instances, so misconfiguration cannot cause exposure. Option C is wrong because AWS Shield Advanced is a DDoS protection service that does not generate false positives for port probes; GuardDuty findings are independent of Shield, and Shield does not mark legitimate traffic as probes. Option D is wrong because the ALB security group only allows HTTP/HTTPS from the internet, and even if it allowed SSH, that would only affect traffic to the ALB, not directly to the instance's private IP; the probes are reaching the instance directly, not through the ALB.

Full explanation →

170

MCQmedium

A company uses AWS Key Management Service (KMS) to encrypt data. The security team needs to ensure that KMS keys cannot be deleted accidentally. Which action should be taken?

A.Apply an SCP that denies kms:ScheduleKeyDeletion for all accounts.

B.Create an IAM policy that denies kms:ScheduleKeyDeletion for the key.

C.Enable automatic key rotation.

D.Enable deletion protection on the key.

AnswerB

This prevents authorized users from scheduling key deletion.

Why this answer

To prevent accidental deletion of KMS keys, you must deny the kms:ScheduleKeyDeletion permission. An IAM policy attached to the key (key policy) or to the user/role can explicitly deny this action. Option B is correct because it directly denies the permission needed to schedule deletion.

Option A (SCP denying kms:ScheduleKeyDeletion) can be used at the organizational level but is not the most direct per-key control. Option C (automatic key rotation) does not prevent deletion. Option D is invalid because KMS does not have a deletion protection toggle; protection is achieved through IAM/key policies.

Full explanation →

171

MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centralize all CloudTrail logs from all accounts into a single S3 bucket in the management account. The bucket policy allows cross-account access. However, logs from member accounts are not being delivered. What is the most likely cause?

A.CloudTrail cannot deliver logs to a bucket in a different account.

B.The S3 bucket is not configured with a CloudTrail prefix.

C.CloudTrail is not enabled in the member accounts.

D.The S3 bucket policy does not grant `s3:PutObject` permission to the member accounts.

AnswerD

Without this permission, CloudTrail cannot write logs to the bucket.

Why this answer

The S3 bucket policy must explicitly grant the `s3:PutObject` permission to the IAM roles or users from the member accounts that CloudTrail uses to deliver logs. Without this permission, CloudTrail in the member accounts cannot write log files to the central bucket, even if the bucket is configured for cross-account access. The bucket policy must also include a condition that the object ownership is set to the bucket owner (via `s3:x-amz-acl: bucket-owner-full-control`) to ensure the management account retains control.

Exam trap

The trap here is that candidates often assume CloudTrail cannot deliver across accounts (Option A) or that a missing prefix (Option B) is the issue, when in fact the root cause is almost always an insufficiently permissive S3 bucket policy that does not grant `s3:PutObject` to the member accounts' CloudTrail roles.

How to eliminate wrong answers

Option A is wrong because CloudTrail can deliver logs to an S3 bucket in a different account when the bucket policy grants the necessary cross-account permissions; this is a standard multi-account logging pattern. Option B is wrong because a CloudTrail prefix is optional and used for organizing logs within a bucket, not for enabling cross-account log delivery; its absence does not prevent log delivery. Option C is wrong because the question states that logs from member accounts are not being delivered, which implies CloudTrail is enabled in those accounts but the delivery is failing due to a permissions issue, not because CloudTrail is disabled.

Full explanation →

172

MCQhard

A company uses Amazon RDS for PostgreSQL with encryption at rest enabled using AWS KMS. The security team wants to ensure that database backups (automated snapshots) are also encrypted and that the encryption key can be rotated on demand without re-encrypting the data. Which approach should be taken?

A.Use a separate KMS key for backups by enabling 'Copy tags to snapshots' and specifying a different key.

B.Disable the old KMS key and enable a new KMS key for the RDS instance. The old backup will remain encrypted with the old key.

C.Enable automatic key rotation in KMS and import new key material every 90 days.

D.Create a new KMS key and modify the RDS instance to use the new key. The existing backup will be re-encrypted with the new key when the instance is modified.

AnswerD

Modifying the RDS instance to use a new KMS key triggers a re-encryption of the data and backups.

Why this answer

You can create a new KMS key and modify the RDS instance to use the new key. This action re-encrypts the database and its automated snapshots with the new key, providing on-demand key rotation. The re-encryption is performed automatically during the modification.

Option A is incorrect because RDS does not allow specifying a separate KMS key for backups; backups use the same key as the instance. Option B is incorrect because disabling the old KMS key would break access to existing backups that are still encrypted with that key. Option C is incorrect because automatic key rotation in KMS does not trigger re-encryption of existing data; it only generates new key material for future encryption operations.

Full explanation →

173

MCQhard

Refer to the exhibit. A security engineer is troubleshooting why an IAM user (Alice) cannot encrypt data using a KMS key. Alice has full S3 and KMS permissions via an IAM policy. The key policy is shown. Which statement explains the issue?

A.The key policy is missing a statement to allow the IAM user to use the key via IAM policies

B.The IAM user does not have the kms:Encrypt permission in their IAM policy

C.The key policy does not include the root account principal

D.The key policy does not allow the IAM user to use the key for any action

AnswerD

Only Admin role gets kms:Put* and kms:Create*, not encrypt.

Why this answer

The key policy does not grant Alice any permissions, and it does not enable IAM policies to allow access (no statement allowing root account to delegate via IAM). Since KMS requires explicit key policy authorization unless the key policy enables IAM policies, Alice cannot encrypt data even with full IAM permissions. Option D correctly identifies this.

Option A is wrong because the key policy does not need a separate statement to allow IAM policies unless it explicitly enables IAM policy delegation. Option B is wrong because Alice has kms:Encrypt via IAM policy, but the key policy is restrictive. Option C is wrong because the root account is included (the Root principal).

Exam trap

A common misconception is that adding 'kms:ViaService' condition is necessary to allow IAM policies. In reality, the key policy must include a statement that delegates authority to the root account (e.g., 'Principal': {'AWS': 'arn:aws:iam::123456789012:root'}, 'Action': 'kms:*', 'Effect': 'Allow'). Without this, even full IAM permissions are insufficient.

Full explanation →

174

Multi-Selecthard

A company wants to enforce encryption in transit for all data transferred between its Amazon EC2 instances and an Application Load Balancer (ALB). The company uses AWS Certificate Manager (ACM) to provision TLS certificates. Which TWO actions should the company take? (Choose TWO.)

Select 2 answers

A.Configure the target group to use HTTPS protocol.

B.Enable encryption at rest on the EC2 instances.

C.Use a network load balancer instead of an ALB.

D.Assign a certificate from ACM to the ALB listener.

E.Configure the ALB listener to use HTTPS protocol.

AnswersA, E

HTTPS target group ensures encryption between ALB and EC2.

Why this answer

Configuring the target group to use HTTPS protocol ensures that traffic between the Application Load Balancer (ALB) and the EC2 instances is encrypted in transit. This enforces TLS encryption on the backend connection, meeting the requirement for data-in-transit protection between the ALB and instances.

Exam trap

The trap here is that candidates often assume assigning a certificate to the ALB listener alone (Option D) is sufficient for encryption in transit, overlooking that the target group protocol must also be HTTPS to enforce encryption on the backend connection between the ALB and EC2 instances.

Full explanation →

175

Multi-Selecthard

A company is using AWS Direct Connect with a private virtual interface (VIF) to connect its on-premises network to a VPC. The security team wants to encrypt traffic over the Direct Connect connection. Which TWO options can be used? (Choose TWO.)

Select 2 answers

A.Use AWS KMS to encrypt the traffic.

B.Use AWS Certificate Manager to issue certificates for the connection.

C.Enable MACsec on the Direct Connect connection.

D.Use SSL/TLS to encrypt the traffic between on-premises and AWS.

E.Establish an IPsec VPN tunnel over the Direct Connect connection.

AnswersC, E

MACsec provides encryption at the data link layer.

Why this answer

MACsec (IEEE 802.1AE) provides encryption at Layer 2 (data link layer) and can be enabled directly on a Direct Connect connection. This encrypts all traffic between the on-premises router and the AWS Direct Connect endpoint without requiring any changes to higher-layer protocols, making it transparent to applications.

Exam trap

The trap here is that candidates often assume encryption must happen at higher layers (like SSL/TLS) or through a separate service (like KMS), but the exam tests knowledge of Layer 2 encryption (MACsec) and Layer 3 encryption (IPsec over Direct Connect) as the two valid methods to encrypt traffic over a Direct Connect connection.

Full explanation →

176

MCQhard

A company is using Amazon GuardDuty to detect threats. The security team notices that GuardDuty findings are not triggering the intended automated response via a CloudWatch Events rule. What is the most likely reason?

A.The CloudWatch Events rule's event pattern does not match the GuardDuty finding event structure.

B.The GuardDuty detector is in a different region than the CloudWatch Events rule.

C.The Lambda function invoked by CloudWatch Events does not have an IAM role assigned.

D.VPC Flow Logs are not enabled.

AnswerA

GuardDuty emits findings to CloudWatch Events as structured events, and the rule's pattern must exactly match their JSON schema. Specifically, the pattern must use "source": ["aws.guardduty"] and "detail-type": ["GuardDuty Finding"]; otherwise the rule is never triggered. If the pattern mismatches, the Lambda function will not be invoked, even though the finding is visible in the GuardDuty console. This is the most common cause of a silent rule failure.

Why this answer

GuardDuty findings are sent to CloudWatch Events as events with a specific structure, including fields like 'detail-type' set to 'GuardDuty Finding' and 'source' set to 'aws.guardduty'. If the CloudWatch Events rule's event pattern does not match this exact structure—for example, if it filters on the wrong 'source' or 'detail-type'—the rule will not trigger the intended automated response. This is the most common reason for the described failure.

Exam trap

The trap here is that candidates often assume the issue is with permissions (Lambda role) or prerequisites (VPC Flow Logs), but the core problem is almost always a mismatch in the event pattern structure, which is a fundamental CloudWatch Events concept.

How to eliminate wrong answers

Option B is wrong because CloudWatch Events rules can be configured to receive events from any region by using a cross-region event bus or by setting up the rule in the same region as the GuardDuty detector; the detector and rule do not need to be in the same region for the rule to match events, but the default behavior is that events are regional unless explicitly configured otherwise. Option C is wrong because the Lambda function's IAM role is only relevant for execution permissions after the rule triggers; if the rule does not match the event, the Lambda function is never invoked, so its role is irrelevant to the triggering issue. Option D is wrong because VPC Flow Logs are not required for GuardDuty to generate findings or for CloudWatch Events to receive them; GuardDuty uses multiple data sources (DNS logs, VPC Flow Logs, CloudTrail logs) but the absence of VPC Flow Logs does not prevent findings from being sent to CloudWatch Events.

Full explanation →

177

Multi-Selectmedium

A company is designing a data protection strategy for sensitive customer data stored in Amazon S3. Which TWO actions should be taken to protect the data from accidental deletion?

Select 2 answers

A.Use S3 Object Lock with retention mode.

B.Enable cross-region replication to another bucket.

C.Configure an S3 bucket policy that denies s3:DeleteObject for all principals.

D.Enable MFA Delete on the S3 bucket.

E.Enable S3 Versioning on the bucket.

AnswersD, E

Requires MFA to delete objects.

Why this answer

Options D and E are correct. MFA Delete adds an extra authentication factor for delete operations, providing protection against accidental or unauthorized deletion. S3 Versioning allows recovery of deleted or overwritten objects by preserving previous versions.

Option A is incorrect because S3 Object Lock with retention mode prevents object deletion or overwrite for a fixed period, but it is not specifically designed to protect against accidental deletion; it is more for compliance. Option B is incorrect because cross-region replication replicates objects to another bucket, but it does not prevent deletion in the source bucket; it only creates copies. Option C is incorrect because a bucket policy that denies s3:DeleteObject for all principals would prevent all delete operations, which is overly restrictive and not a practical solution for protecting against accidental deletion while still allowing necessary administrative actions.

Full explanation →

178

MCQeasy

A DevOps engineer needs to monitor failed SSH login attempts to Amazon EC2 instances. Which AWS service should the engineer use to collect and analyze the login events?

A.AWS Config

B.Amazon CloudWatch Logs

C.AWS CloudTrail

D.VPC Flow Logs

AnswerB

Amazon CloudWatch Logs is the correct choice because the CloudWatch agent (or the legacy Logs agent) can be installed on an EC2 instance to tail local system logs, including /var/log/auth.log on Amazon Linux or /var/log/secure on RHEL/CentOS. Once collected, you can define a metric filter to match patterns such as 'Failed password' or 'Connection refused' that sshd emits on failed attempts, and then trigger alarms based on those metrics. This directly captures the OS-level authentication events needed to monitor failed SSH logins.

Why this answer

Amazon CloudWatch Logs is the correct service because it can ingest, monitor, and analyze log data from EC2 instances, including SSH authentication logs (e.g., /var/log/secure or /var/log/auth.log). By installing the CloudWatch Logs agent on the EC2 instance, the engineer can stream these log events to CloudWatch Logs, where they can be searched, visualized, and used to trigger alarms on failed SSH attempts. AWS Config tracks resource configuration changes, not OS-level login events; CloudTrail records AWS API calls, not guest OS logs; and VPC Flow Logs capture network traffic metadata, not application or authentication logs.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs AWS API calls) with OS-level auditing, mistakenly thinking CloudTrail captures guest OS login events, when in fact CloudTrail only records control-plane actions and never sees inside the instance's operating system.

How to eliminate wrong answers

Option A is wrong because AWS Config is a service for evaluating and recording changes to AWS resource configurations (e.g., security group rules, instance types), not for collecting or analyzing OS-level login events like SSH attempts. Option C is wrong because AWS CloudTrail logs API calls made to the AWS control plane (e.g., RunInstances, DescribeInstances), not guest OS activities such as SSH logins, which occur within the instance's operating system. Option D is wrong because VPC Flow Logs capture metadata about IP traffic flowing to and from network interfaces (e.g., source/destination IP, ports, protocol), but they do not log application-layer events like SSH authentication successes or failures.

Full explanation →

179

Multi-Selectmedium

Which TWO AWS services can be used to monitor and audit data access patterns to Amazon S3 buckets? (Choose 2.)

Select 2 answers

A.AWS Config

B.AWS CloudWatch

C.AWS CloudTrail

D.Amazon S3 Server Access Logs

E.AWS Trusted Advisor

AnswersC, D

Logs S3 API calls.

Why this answer

AWS CloudTrail is correct because it records API activity for Amazon S3, including data-level events such as GetObject, PutObject, and DeleteObject. By enabling data events on a trail, you can capture who accessed which object, from which IP address, and when, providing a complete audit trail for data access patterns.

Exam trap

The trap here is that candidates often confuse AWS Config (which checks configuration compliance) with CloudTrail (which records API activity), or they overlook that S3 Server Access Logs are a separate, native logging feature distinct from CloudTrail.

Full explanation →

180

MCQeasy

A security engineer needs to monitor for suspicious API calls in near real-time and trigger an automated response. Which AWS service should be used to capture and analyze these API calls?

A.AWS CloudHSM

B.Amazon GuardDuty

C.AWS CloudTrail

D.AWS Config

AnswerC

AWS CloudTrail records API calls for audit and can be integrated with CloudWatch Logs for near real-time monitoring.

Why this answer

AWS CloudTrail is the correct service because it captures all API calls made to the AWS environment, including those from the AWS Management Console, SDKs, CLI, and AWS services. By enabling CloudTrail Insights or using CloudWatch Events with CloudTrail logs, you can monitor for suspicious API calls in near real-time and trigger automated responses via Lambda functions or SNS notifications.

Exam trap

The trap here is that candidates confuse GuardDuty's threat detection capabilities with the actual capture of API calls, forgetting that GuardDuty consumes CloudTrail logs rather than generating them, so the service that captures the calls is CloudTrail, not GuardDuty.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides hardware security modules for cryptographic key storage and operations, not for monitoring or analyzing API calls. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events for malicious activity, but it does not natively capture API calls itself—it relies on CloudTrail as a data source, and the question asks for the service that captures and analyzes the calls, not just analyzes them. Option D is wrong because AWS Config evaluates resource configurations against desired policies and tracks configuration changes, but it does not capture or analyze API calls; it focuses on resource state, not the API actions that led to that state.

Full explanation →

181

MCQmedium

An administrator wants to audit all IAM actions in the account. Which AWS service should be used?

A.AWS Config

B.Amazon GuardDuty

C.AWS CloudTrail

D.Amazon CloudWatch

AnswerC

AWS CloudTrail records API activity, which includes all IAM actions.

Why this answer

AWS CloudTrail records API activity, including all IAM actions. AWS Config tracks resource configuration changes, not API actions. Amazon GuardDuty is a threat detection service.

Amazon CloudWatch monitors metrics and logs, but does not record API calls.

Full explanation →

182

MCQhard

A security engineer is configuring a VPC for a highly sensitive application. The VPC must not have a route to the internet, but the application needs to periodically download security patches from a specific domain (patches.example.com). Which solution meets these requirements with minimal operational overhead?

A.Launch a proxy server in a public subnet and configure the application to use the proxy.

B.Use a VPC endpoint for Amazon S3 and DynamoDB to download patches.

C.Create a VPC interface endpoint for AWS Systems Manager and use Systems Manager Patch Manager to apply patches.

D.Deploy a NAT gateway in a public subnet and add a route to the NAT gateway for the private subnet.

AnswerB

A VPC endpoint for Amazon S3 (a gateway endpoint) allows resources in private subnets to access S3 using private IP addresses with traffic staying entirely within the AWS network, without any internet gateway, NAT device, or VPN connection. Since patches are stored in S3 buckets, the application can retrieve patch files directly over the endpoint, and an endpoint for DynamoDB can handle patch metadata or state tables. This satisfies the no-internet-route requirement while enabling secure patch downloads.

Why this answer

It uses VPC endpoints for Amazon S3 (and optionally DynamoDB) to provide private connectivity to AWS services without requiring an internet gateway. By storing the security patches in an S3 bucket with a custom domain alias (e.g., patches.example.com), the application can download patches through the VPC endpoint, meeting the requirement of no internet route and minimizing operational overhead. Options A and D require an internet gateway, which creates a route to the internet.

Option C does not provide access to an external domain like patches.example.com.

Exam trap

Candidates may assume that AWS Systems Manager Patch Manager can download patches from any external domain via VPC endpoints, but SSM endpoints only provide private access to AWS services, not arbitrary external domains. The correct approach is to store patches in an AWS service like S3 and use a VPC endpoint.

How to eliminate wrong answers

Option A is wrong because launching a proxy server in a public subnet requires the VPC to have an internet gateway and a route to the internet, which violates the requirement that the VPC must not have a route to the internet. Option B is wrong because VPC endpoints for Amazon S3 and DynamoDB are designed for accessing those specific AWS services, not for downloading patches from an external domain like patches.example.com; they cannot route traffic to arbitrary internet destinations. Option D is wrong because deploying a NAT gateway in a public subnet requires the VPC to have an internet gateway attached to the public subnet, which again creates a route to the internet, directly contradicting the requirement.

Full explanation →

183

MCQhard

A company uses Amazon Detective to investigate security findings. The security team is analyzing a GuardDuty finding of type 'Backdoor:EC2/C&CActivity.B!DNS' for an EC2 instance. The team wants to use Detective to understand the full scope of the incident, including which other resources the instance communicated with and any IAM roles used. However, when the team opens the finding in Detective, they see no network activity data for the instance. The instance is in a VPC with VPC Flow Logs enabled, and Flow Logs are being published to CloudWatch Logs. What should the team do to enable Detective to display the network activity?

A.Re-enable the GuardDuty finding in Amazon Detective.

B.Enable GuardDuty EKS Audit Logs monitoring.

C.Ensure that VPC Flow Logs are enabled for the VPC and are being published to Amazon CloudWatch Logs in the same account and Region as Detective.

D.Install the Amazon Detective agent on the EC2 instance.

AnswerC

Amazon Detective relies on VPC Flow Logs to populate the network activity details on a finding, such as source/destination IPs, ports, and protocol. For those flow logs to be ingested, they must be enabled for the relevant VPC and published to Amazon CloudWatch Logs in the same AWS account and Region as the Detective graph. Without this configuration, Detective can still show the GuardDuty finding and some API activity, but the network path section will be empty—so enabling VPC Flow Logs is the correct fix.

Why this answer

Amazon Detective ingests VPC Flow Logs from CloudWatch Logs to generate network activity visualizations for EC2 instances. Even though VPC Flow Logs are enabled and published to CloudWatch Logs, Detective requires that the logs are in the same AWS account and Region as the Detective behavior graph. If the logs are in a different account or Region, Detective cannot access them, resulting in no network activity data being displayed for the instance.

Exam trap

The trap here is that candidates assume simply enabling VPC Flow Logs and publishing to CloudWatch Logs is sufficient, but they overlook the requirement that the logs must be in the same AWS account and Region as the Detective behavior graph for ingestion to occur.

How to eliminate wrong answers

Option A is wrong because re-enabling the GuardDuty finding in Detective does not affect the ingestion of VPC Flow Logs; Detective automatically ingests findings from GuardDuty when the integration is enabled, and the issue is with missing network data, not the finding itself. Option B is wrong because GuardDuty EKS Audit Logs monitoring is specific to Amazon EKS clusters and has no relevance to EC2 instance network activity or VPC Flow Logs. Option D is wrong because Amazon Detective does not require or use an agent on EC2 instances; it relies on existing data sources like VPC Flow Logs, GuardDuty findings, and CloudTrail logs, and installing an agent would not enable network activity visualization.

Full explanation →

184

MCQmedium

A security team needs to audit all changes to IAM resources in their AWS account. Which AWS service should they use?

A.VPC Flow Logs

B.AWS CloudTrail

C.AWS Config

D.Amazon CloudWatch Logs

AnswerB

CloudTrail records all AWS API calls for auditing.

Why this answer

AWS CloudTrail records API calls made in the AWS account, including changes to IAM resources. Therefore, option B is correct. Option A is wrong because VPC Flow Logs capture network traffic, not IAM changes.

Option C is wrong because AWS Config records resource configuration changes but does not capture all API calls; it can be used to track IAM changes but CloudTrail is the primary service for API audit. Option D is wrong because CloudWatch Logs stores logs from various sources but does not capture API calls by default; it can be integrated with CloudTrail but is not the service that directly records IAM changes.

Full explanation →

185

MCQmedium

A security engineer is reviewing an IAM policy attached to a user. The policy is intended to allow the user to read objects from an S3 bucket only from the office IP range 192.0.2.0/24. However, the user reports that they can access objects from any IP address. What is the most likely reason?

A.The policy does not include an explicit Deny for requests outside the IP range.

B.The condition key is misspelled; it should be aws:SourceIp without the 's'.

C.The policy is attached to the user, but the bucket has a bucket policy that allows public access.

D.The resource ARN is missing the bucket name.

AnswerA

Without explicit Deny, other policies may allow access.

Why this answer

IAM policies do not have an explicit Deny by default; the Allow with condition only grants access from the specified IP range. However, other policies (like a bucket policy or another IAM policy) could grant access from other IPs, overriding the condition. To prevent access from outside the IP range, an explicit Deny for all other IPs is required.

Option B is incorrect because the condition key 'aws:SourceIp' is correctly spelled; it uses a capital 'S' and 'I'. Option C is incorrect because while a bucket policy allowing public access could override, the most likely reason in this scenario is that the IAM policy is missing an explicit Deny, as that is a common misconfiguration. Option D is incorrect because if the resource ARN is missing the bucket name, the policy would not apply to the bucket at all, and the user would not have access, contradicting the ability to access from any IP.

Full explanation →

186

MCQmedium

A company has an S3 bucket with a bucket policy that grants access to a specific IAM role. However, users who assume that role are unable to list objects in the bucket. The bucket policy includes a Principal element set to the role ARN. What is the MOST likely cause?

A.The IAM role does not have a permissions policy that allows s3:ListBucket.

B.The bucket has an ACL that denies access to the role.

C.The bucket policy requires MFA, but the role does not enforce MFA.

D.The role's trust policy does not allow sts:AssumeRole.

AnswerA

The IAM role needs a permissions policy that allows s3:ListBucket. A bucket policy alone does not grant access to IAM principals; the role must also have an IAM policy allowing the action.

Why this answer

Bucket policies do not grant permissions to IAM role principals unless the role has an IAM policy that allows the S3 action. Option B is false; ACLs are not the issue here; the role lacks an IAM policy. Option C is false; the scenario does not involve MFA, and even if MFA were required, the role’s inability to list objects is due to missing IAM permissions.

Option D is false; the role’s trust policy allows AssumeRole, otherwise the users could not assume the role.

Full explanation →

187

MCQeasy

A security engineer is investigating a potential data exfiltration from an S3 bucket. Which AWS service should be used to analyze the VPC Flow Logs for the S3 bucket's endpoint?

A.Amazon Macie

B.Amazon Inspector

C.Amazon GuardDuty

D.Amazon Detective

AnswerD

Amazon Detective is purpose-built for security investigation: it ingests VPC Flow Logs, AWS CloudTrail, and EKS audit logs and automatically builds an interactive graph of network traffic, resource interactions, and IAM identities. You can expand a suspected instance to view all of its inbound/outbound connections, the aggregate bytes transferred per peer, and the API actions performed around each flow, which directly answers whether and how data exfiltration occurred. This interactive, multi-source correlation is exactly what the other options lack.

Why this answer

Amazon Detective is the correct service because it can ingest and analyze VPC Flow Logs, including those for a VPC endpoint used to access an S3 bucket. Detective uses machine learning, statistical analysis, and graph theory to identify the root cause of suspicious network traffic patterns, such as unusual data volumes or connections to external IPs, which are indicative of data exfiltration.

Exam trap

The trap here is that candidates confuse Amazon GuardDuty's alerting capability with Amazon Detective's investigative analysis, forgetting that GuardDuty generates findings but Detective is needed for deep forensic analysis of VPC Flow Logs to understand the full scope of an incident.

How to eliminate wrong answers

Option A is wrong because Amazon Macie is a data security service that uses machine learning to discover, classify, and protect sensitive data stored in S3 buckets, but it does not analyze VPC Flow Logs or network traffic. Option B is wrong because Amazon Inspector is a vulnerability management service that scans EC2 instances and container workloads for software vulnerabilities and unintended network exposure, not for analyzing VPC Flow Logs. Option C is wrong because Amazon GuardDuty is a threat detection service that can monitor VPC Flow Logs for malicious activity, but it is a continuous monitoring and alerting service, not an investigative tool for deep analysis of historical flow log data; Detective is designed for post-breach root-cause analysis.

Full explanation →

188

MCQmedium

Refer to the exhibit. A security engineer configured this S3 bucket policy for CloudTrail, but CloudTrail logs are not being delivered. What is the MOST likely missing permission?

A.Missing s3:GetBucketAcl permission.

B.The condition StringEquals should be StringLike.

C.Missing s3:PutObject permission for the bucket.

D.The bucket ARN is incorrect.

AnswerC

CloudTrail also requires s3:PutObject on the bucket ARN to write log files, not just the prefix.

Why this answer

CloudTrail requires that the S3 bucket policy grants the s3:PutObject permission to the CloudTrail service principal to write log files. The exhibit shows a bucket policy that grants s3:GetBucketAcl but is missing a statement that allows s3:PutObject on the bucket (or on the appropriate log prefix). Without s3:PutObject, CloudTrail cannot deliver log files to the bucket.

Therefore, the most likely missing permission is s3:PutObject for the bucket, making option C correct.

Full explanation →

189

MCQmedium

A company uses AWS Organizations with SCPs to restrict services. An administrator creates an SCP that denies access to EC2. A developer in a member account tries to launch an EC2 instance but fails. What is the most likely reason?

A.The SCP from the organization denies EC2

B.The root user of the account has denied EC2

C.The developer's IAM permissions boundary blocks EC2

D.The EC2 instance has a resource-based policy denying access

AnswerA

SCPs apply to all principals in the account.

Why this answer

Service Control Policies (SCPs) in AWS Organizations act as a centralized governance mechanism that applies a deny effect across all IAM principals in member accounts. When an SCP explicitly denies access to EC2, it overrides any allow permissions at the account level, including those granted by IAM policies. The developer's launch attempt fails because the SCP's deny is evaluated before any account-level permissions, effectively blocking the action regardless of the developer's IAM role or user permissions.

Exam trap

The trap here is that candidates often assume IAM permissions or permissions boundaries are the primary cause of access failures, overlooking that SCPs apply a blanket deny that overrides all account-level permissions, including those of the root user.

How to eliminate wrong answers

Option B is wrong because the root user of a member account is also subject to SCPs from the organization; while the root user has full permissions by default, an SCP that denies EC2 applies to the root user as well, so the root user cannot bypass the SCP to allow EC2. Option C is wrong because an IAM permissions boundary limits the maximum permissions a principal can have, but it does not deny actions by itself; if the developer's IAM policy allowed EC2 and the boundary did not explicitly deny EC2, the boundary would not cause the failure—the SCP's deny is the overriding factor. Option D is wrong because EC2 instances do not have resource-based policies that control who can launch them; resource-based policies are used for services like S3 buckets or Lambda functions, not for controlling the ability to create EC2 instances.

Full explanation →

190

Multi-Selectmedium

Which TWO actions can be used to restrict access to an S3 bucket to only users who authenticate using multi-factor authentication (MFA)? (Choose TWO.)

Select 2 answers

A.Use AWS CloudTrail to log requests and deny those without MFA

B.Use pre-signed URLs with MFA credentials

C.Set an S3 bucket ACL that requires MFA

D.Add a condition in the IAM policy that checks aws:MultiFactorAuthPresent is true

E.Add a condition in the bucket policy that checks aws:MultiFactorAuthPresent is true

AnswersB, E

Pre-signed URLs can be generated with MFA, requiring MFA for access.

Why this answer

The correct answers are B and E. Option B: Pre-signed URLs generated with MFA credentials require the user to authenticate with MFA before accessing the S3 object. Option E: A bucket policy with a condition `aws:MultiFactorAuthPresent: true` enforces MFA for all operations on the bucket.

Option A is wrong because AWS CloudTrail only logs API calls, it does not enforce access control. Option C is wrong because S3 bucket ACLs do not support conditions to check MFA. Option D is wrong because IAM policies with MFA conditions apply at the user/group level, not directly to the S3 bucket; the bucket policy is needed to restrict bucket access.

Full explanation →

191

MCQeasy

A security engineer needs to ensure that all API calls in an AWS account are logged for incident response. Which AWS service should be enabled?

A.Amazon GuardDuty

B.VPC Flow Logs

C.AWS Config

D.AWS CloudTrail

AnswerD

AWS CloudTrail is the only service that directly records AWS API activity as first-class audit log events. When enabled, it captures the identity of the caller (IAM user or role), the source IP address, the requested action, request parameters, and the response returned by the service, for both management events and (when configured) data events. These logs can be delivered to Amazon S3 and CloudWatch Logs, and the trail can be multi-region and organization-wide, making CloudTrail the authoritative record of every API call for incident response and governance. Unlike anomaly-detection services such as GuardDuty, CloudTrail does not infer or analyze behavior—it simply logs each call exactly as it occurred.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This logging is essential for incident response to reconstruct events and identify unauthorized or malicious activity.

Exam trap

The trap here is that candidates confuse AWS Config with CloudTrail because both deal with 'logging' and 'compliance,' but Config tracks resource state changes over time, not the API calls that caused those changes.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that analyzes logs (like CloudTrail, VPC Flow Logs, and DNS logs) for malicious activity, but it does not itself generate or store API call logs. Option B is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) at the elastic network interface level, not API calls to AWS services. Option C is wrong because AWS Config records resource configuration changes and evaluates compliance rules, but it does not log API calls; it relies on CloudTrail for API history.

Full explanation →

192

Multi-Selectmedium

A company's security team is implementing an incident response plan for a potential ransomware attack on their EC2 instances. Which THREE steps should the team take to preserve forensic evidence while containing the incident?

Select 3 answers

A.Create an EBS snapshot of the root volume.

B.Create an Amazon Machine Image (AMI) of the compromised instance.

C.Isolate the instance by modifying the security group to deny all traffic.

D.Stop the instance to preserve its state.

E.Delete the compromised instance immediately.

AnswersA, B, C

A snapshot preserves the root volume data.

Why this answer

Creating an EBS snapshot of the root volume preserves the exact disk state at the time of the incident, including any ransomware artifacts, file system metadata, and encryption keys. This snapshot can be used for offline forensic analysis without altering the original evidence, as it captures the block-level data of the volume.

Exam trap

The trap here is that candidates often confuse 'stopping' an instance with 'preserving state,' but stopping triggers a graceful shutdown that can alter evidence, whereas an EBS snapshot captures the live disk state without halting the instance.

Full explanation →

193

MCQeasy

A company wants to centralize logs from multiple AWS accounts into a single S3 bucket for analysis. The accounts are part of an AWS Organizations organization. Which set of steps will accomplish this?

A.Create an organization trail in the management account with logging enabled for all accounts.

B.Use AWS Config to aggregate logs from all accounts into a central S3 bucket.

C.Create a CloudTrail trail in each account and configure each to write to the same S3 bucket.

D.Set up Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.

AnswerA

CloudTrail organization trails are created in the management account and automatically apply to every account in AWS Organizations, delivering all account logs to a single S3 bucket without per-account configuration. This is the native mechanism for centralizing management-event logging across an organization, and the management account owns and controls the trail. Because the trail is organization-wide, you get consistent logging coverage and centralized governance.

Why this answer

AWS Organizations allows you to create an organization trail from the management account. When you enable logging for all accounts in the organization, CloudTrail automatically creates a trail that applies to every account in the organization, delivering log files from all accounts to a single S3 bucket without needing per-account configuration.

Exam trap

The trap here is that candidates often assume each account must individually configure CloudTrail to write to a shared bucket, overlooking the organization trail feature that automates multi-account log centralization through AWS Organizations.

How to eliminate wrong answers

Option B is wrong because AWS Config aggregates configuration items and compliance snapshots, not CloudTrail logs; it is designed for resource configuration tracking, not centralized log delivery. Option C is wrong because while each account can write to the same S3 bucket, this approach requires manual setup per account, does not leverage Organizations for automatic multi-account management, and can lead to permission conflicts or log delivery failures without proper bucket policies. Option D is wrong because Amazon Kinesis Data Firehose is a streaming data delivery service, not a native CloudTrail log destination; CloudTrail cannot directly send logs to Firehose without additional configuration, and this approach does not provide the centralized, automatic trail management that an organization trail offers.

Full explanation →

194

Multi-Selectmedium

A company is implementing a data retention policy for CloudTrail logs. The logs are stored in an S3 bucket. The policy requires that logs be retained for 7 years and then automatically deleted. Which TWO actions should the security engineer take to meet this requirement?

Select 2 answers

A.Use AWS Backup to manage retention and deletion.

B.Enable S3 Object Lock in compliance mode on the bucket.

C.Configure the S3 bucket policy to deny s3:DeleteObject actions for all principals.

D.Enable S3 Versioning and create a lifecycle policy to delete noncurrent versions.

E.Create an S3 Lifecycle policy that expires objects after 2555 days (7 years).

AnswersB, E

Correct. Enabling S3 Object Lock in compliance mode prevents any deletion of objects during the retention period, ensuring logs are retained for 7 years.

Why this answer

To retain logs for 7 years and then automatically delete, the security engineer should enable S3 Object Lock in compliance mode (B) to prevent any deletion during the retention period, and create an S3 Lifecycle policy to expire objects after 2555 days (E). The Object Lock ensures logs cannot be deleted prematurely, while the lifecycle policy handles automatic deletion after 7 years. Option C is incorrect because denying s3:DeleteObject to all principals would block the lifecycle policy from deleting objects.

Options A and D are not suitable for this requirement.

Full explanation →

195

MCQeasy

A security analyst needs to detect and alert on suspicious API calls in real time. Which combination of AWS services should be used?

A.AWS CloudTrail, Amazon CloudWatch Logs, and Amazon EventBridge.

B.Amazon Inspector and AWS CloudTrail.

C.Amazon GuardDuty and AWS Lambda.

D.AWS Config and Amazon SNS.

AnswerA

Correct combination for real-time alerting on API calls.

Why this answer

AWS CloudTrail captures API calls and delivers log files to Amazon CloudWatch Logs, where you can define metric filters to detect suspicious patterns. Amazon EventBridge then consumes those filtered log events to trigger real-time alerts or automated remediation actions. This combination provides the end-to-end pipeline needed for real-time detection and alerting on API activity.

Exam trap

The trap here is that candidates often assume GuardDuty alone can provide real-time API call alerts, but GuardDuty findings are based on aggregated threat intelligence and behavioral analysis, not real-time per-API-call filtering, whereas CloudTrail plus CloudWatch Logs plus EventBridge gives you precise, real-time control over specific API actions.

How to eliminate wrong answers

Option B is wrong because Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and network exposure, not a real-time API call detection service. Option C is wrong because while Amazon GuardDuty can detect suspicious API activity using threat intelligence and anomaly detection, it does not natively provide real-time alerting on specific API calls; it generates findings that are typically evaluated asynchronously, and AWS Lambda alone cannot capture or filter API calls without a source like CloudTrail. Option D is wrong because AWS Config is a resource inventory and compliance service that tracks configuration changes, not API calls, and Amazon SNS is a notification service that requires a source of events (like CloudTrail and CloudWatch Logs) to deliver alerts.

Full explanation →

196

MCQhard

During an incident response, a security engineer needs to capture a forensic image of an EC2 instance's root volume for analysis. The instance is running and cannot be stopped. What is the recommended approach to capture the volume without stopping the instance?

A.Use the dd command via AWS Systems Manager to create a raw image and store it in S3.

B.Detach the volume from the instance, create a snapshot, and then attach it to a forensic analysis instance.

C.Create a snapshot while the volume is attached to the instance.

D.Use AWS Systems Manager to run a command that copies the volume content to S3.

AnswerC

Creating a snapshot while the volume is attached is the correct approach because Amazon EBS snapshots are designed to be taken of in-use volumes without stopping the instance. The snapshot is crash-consistent (or file-system-consistent if the instance has the AWS backup agent or you freeze the filesystem), and it provides a point-in-time forensic copy that can later be analyzed by creating a new volume from the snapshot. This satisfies the incident response requirement to preserve evidence while keeping the instance running for continued investigation or memory acquisition.

Why this answer

The correct approach is to create a snapshot of the EBS root volume while it is still attached to the running instance (Option C). Snapshots can be taken of in-use volumes without stopping the instance, providing a point-in-time copy for forensic analysis. Option B is incorrect because you cannot detach the root volume of a running instance without first stopping it, which contradicts the requirement not to stop the instance.

Exam trap

Candidates often mistakenly believe that the root volume can be detached while the instance is running (Option B), or that a snapshot requires stopping the instance. In reality, snapshots of attached volumes are allowed and are the recommended method for capturing forensic images without downtime.

How to eliminate wrong answers

Option A is wrong because the dd command via AWS Systems Manager would require the volume to be unmounted or the instance to be stopped to avoid data corruption from concurrent writes, and storing a raw image in S3 is inefficient and not a standard forensic practice. Option C is wrong because creating a snapshot while the volume is attached is actually the correct first step, but the question asks for the full recommended approach to capture the volume for analysis, which includes using the snapshot to create a new volume and attach it to a forensic instance—not just taking the snapshot. Option D is wrong because AWS Systems Manager cannot directly copy volume content to S3 without first creating a snapshot or using a tool like dd, which would require the volume to be unmounted or the instance to be stopped to ensure consistency.

Full explanation →

197

MCQeasy

A company uses Amazon S3 to store sensitive documents. The security team wants to ensure that all objects are encrypted at rest using server-side encryption. Additionally, any attempt to upload an unencrypted object must be denied. What should the security team do?

A.Enable default encryption on the S3 bucket using SSE-S3.

B.Add an S3 bucket policy that requires encryption using the 's3:x-amz-server-side-encryption' condition key.

C.Add an S3 bucket policy that denies PutObject if the object is not encrypted using SSE-S3 or SSE-KMS.

D.Create an AWS Config rule to detect unencrypted objects and trigger a Lambda function to encrypt them.

AnswerC

Denying unencrypted uploads enforces encryption at upload time.

Why this answer

An S3 bucket policy that denies PutObject if the object is not encrypted using SSE-S3 or SSE-KMS ensures that any upload attempt without proper server-side encryption is blocked. Option A is incorrect because enabling default encryption does not deny unencrypted uploads if the request explicitly sets encryption to none. Option B is incorrect because the 's3:x-amz-server-side-encryption' condition key can require encryption but does not cover all cases; using a deny statement for unencrypted uploads is more robust.

Option D is incorrect because AWS Config can only detect non-compliance, not deny the upload in real-time.

Full explanation →

198

MCQeasy

A company uses AWS CloudTrail to log all API activity. The security team wants to ensure that any changes to CloudTrail configuration (e.g., disabling the trail, deleting the trail, modifying the log delivery) are detected immediately. They have created a CloudWatch Events rule to capture the event 'StopLogging' and send an SNS notification. During testing, the team stops the trail and does not receive the notification. The CloudWatch Events rule is configured with the correct event pattern. What should the team check?

A.Verify that the CloudTrail trail is logging management events.

B.Ensure that the event pattern includes the correct source and detail-type.

C.Confirm that the SNS topic subscription is confirmed.

D.Check the IAM role associated with the CloudWatch Events rule to ensure it has permissions to publish to the SNS topic.

AnswerD

CloudWatch Events rules that target an SNS topic must assume an IAM role that grants sns:Publish on that topic's ARN. Without that permission, the rule fails at execution time with an AccessDenied error, even though the event pattern matched and the rule appears to have fired. The correct fix is to verify the role's trust policy allows events.amazonaws.com to assume it and that the attached policy includes the exact sns:Publish action for the target topic.

Why this answer

CloudWatch Events rules require an IAM role with permissions to invoke the target (e.g., publish to SNS). Even if the event pattern matches and the SNS topic exists, without a properly configured IAM role that grants `sns:Publish` to the CloudWatch Events service, the rule cannot deliver the notification. This is a common misconfiguration that causes silent failures.

Exam trap

The trap here is that candidates assume the event pattern matching is the only requirement for delivery, overlooking the IAM permissions needed for the CloudWatch Events rule to invoke the SNS target.

How to eliminate wrong answers

Option A is wrong because the issue is about receiving a notification for the 'StopLogging' event, not about whether the trail logs management events; CloudTrail must log management events for the event to appear, but the team already captured the event pattern correctly, so this is not the immediate cause of the missing notification. Option B is wrong because the question states the CloudWatch Events rule is configured with the correct event pattern, so the source and detail-type are already correct; checking them again would not resolve the delivery failure. Option C is wrong because the SNS topic subscription confirmation is only relevant for email or HTTP endpoints; if the SNS topic is used as a CloudWatch Events target, the subscription is automatically confirmed by the service, so this is not the likely cause.

Full explanation →

199

Multi-Selectmedium

Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)

Select 2 answers

A.Enable DNS query logging and publish to CloudWatch Logs.

B.Enable VPC Flow Logs and publish to CloudWatch Logs.

C.Enable CloudTrail data events for S3.

D.Enable S3 server access logs.

E.Enable AWS Config configuration history.

AnswersA, B

GuardDuty uses DNS logs for domain-based threat detection.

Why this answer

Amazon GuardDuty relies on DNS query logs to detect suspicious domain name resolution patterns, such as DNS tunneling or communication with known malicious domains. By enabling DNS query logging and publishing to CloudWatch Logs, GuardDuty can ingest this data as a source for its threat detection algorithms. Without DNS logs, GuardDuty cannot analyze DNS-based attack vectors within the VPC.

Exam trap

The trap here is that candidates often think enabling CloudTrail or S3 logs is sufficient for VPC monitoring, but GuardDuty specifically requires VPC Flow Logs and DNS query logs as its primary network-based data sources for detecting suspicious VPC activity.

Full explanation →

200

Multi-Selecthard

A company wants to encrypt data at rest for an Amazon RDS for MySQL DB instance. Which THREE options can be used to achieve this? (Choose THREE.)

Select 3 answers

A.Take a snapshot of the unencrypted instance, copy it with encryption, and restore.

B.Modify the DB instance to enable encryption after creation.

C.Create a read replica with encryption enabled, even if the source is unencrypted.

D.Enable encryption on an existing read replica of an encrypted source.

E.Enable encryption when creating the DB instance.

AnswersA, D, E

This is a valid method to encrypt an existing database.

Why this answer

You can take a snapshot of an unencrypted Amazon RDS for MySQL DB instance, create an encrypted copy of that snapshot, and then restore a new DB instance from the encrypted snapshot. This process effectively encrypts the data at rest, as the restored instance will inherit the encryption setting from the snapshot. AWS RDS does not allow enabling encryption on an existing unencrypted DB instance directly, so this snapshot-based approach is the standard workaround.

Exam trap

The trap here is that candidates assume you can enable encryption on an existing RDS instance via a simple modification (Option B), but AWS explicitly prohibits this, requiring a snapshot-based migration instead.

Full explanation →

201

Multi-Selectmedium

Which TWO actions are valid ways to grant an IAM user access to an S3 bucket owned by another AWS account? (Choose TWO.)

Select 2 answers

A.Have the user assume an IAM role in the bucket-owning account with appropriate permissions.

B.Create a bucket policy that grants access to the user's AWS account.

C.Attach an IAM policy to the user in their own account allowing access to the bucket.

D.Add the user's ARN to the bucket's ACL.

E.Use an S3 access point with a policy that allows the user.

AnswersA, B

Cross-account role assumption grants temporary access.

Why this answer

Correct answers are A and B. Option A: Assuming a role in the bucket-owning account is a standard cross-account access method. Option B: A bucket policy granting access to the user's AWS account, combined with the user having appropriate IAM permissions (e.g., s3:GetObject), allows access.

Option C is incorrect because the user's own IAM policy cannot grant access to resources in another account; the resource owner must grant access. Option D is incorrect because ACLs do not support granting access to an IAM user ARN; they only support AWS accounts or predefined groups. Option E is incorrect because S3 access points are used within the same account or with bucket policies, but cannot be used to grant access to an IAM user in another account directly.

Full explanation →

202

Multi-Selecthard

A company uses AWS KMS to encrypt data in Amazon S3. The security team wants to ensure that only users from a specific AWS account can decrypt objects. Which TWO steps should be taken to achieve this?

Select 2 answers

A.Add a bucket policy that denies decrypt for all users except those from the target account.

B.Configure the KMS key policy to allow the target AWS account to use the key for decrypt.

C.Use a different KMS key for each object to isolate permissions.

D.Create an IAM policy in the target account that allows the kms:Decrypt action.

E.Enable S3 default encryption with the KMS key.

AnswersB, D

KMS key policy must allow the target account to use the key for decrypt.

Why this answer

Options B and D are correct. To allow decryption by a specific AWS account, you must configure the KMS key policy to grant the target account permission to use the key for decrypt (option B). Additionally, the target account must create an IAM policy that allows its users to call the kms:Decrypt action (option D).

Option A is incorrect because S3 bucket policies cannot grant KMS decryption permissions; they only control S3 operations. Option C is incorrect because using a separate KMS key per object adds unnecessary complexity and does not solve the cross-account requirement. Option E is incorrect because enabling S3 default encryption with a KMS key does not restrict decryption to a specific account; it only ensures encryption is applied.

Full explanation →

203

MCQeasy

A company wants to encrypt data at rest in an Amazon S3 bucket. Which AWS service can centrally manage the encryption keys?

A.AWS CloudHSM

B.AWS Certificate Manager (ACM)

C.AWS Key Management Service (AWS KMS)

D.AWS Secrets Manager

AnswerC

AWS Key Management Service (AWS KMS) is a fully managed service that centralizes the creation, storage, rotation, and deletion of customer master keys (CMKs). S3 integrates with KMS through server-side encryption (SSE-KMS), where S3 uses a KMS key to encrypt each object's data key automatically and enforces IAM policies on key usage. This gives you centralized control, auditability through CloudTrail, and seamless S3 encryption, making KMS the correct and standard service for encrypting data at rest in S3.

Why this answer

AWS Key Management Service (AWS KMS) is the correct service because it is a fully managed, centralized service that allows you to create, manage, and control the encryption keys used to encrypt data at rest in Amazon S3. S3 integrates directly with KMS via Server-Side Encryption with AWS KMS (SSE-KMS), enabling you to use customer managed keys (CMKs) or AWS managed keys to enforce granular access control and audit key usage through AWS CloudTrail.

Exam trap

The trap here is that candidates often confuse AWS CloudHSM with KMS because both involve encryption keys, but CloudHSM is a hardware-based key storage service that lacks native integration with S3 for centralized key management, whereas KMS is the intended service for SSE-KMS.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides dedicated hardware security modules (HSMs) for generating and storing keys, but it does not centrally manage encryption keys for S3; it requires manual integration and does not offer native S3 encryption key management. Option B is wrong because AWS Certificate Manager (ACM) is designed to provision, manage, and deploy public and private SSL/TLS certificates for network encryption, not for managing encryption keys for data at rest in S3. Option D is wrong because AWS Secrets Manager is used to securely store and rotate secrets such as database credentials and API keys, not to centrally manage encryption keys for S3 server-side encryption.

Full explanation →

204

Multi-Selecthard

A company has a security policy that requires all IAM users to use multi-factor authentication (MFA) when accessing the AWS Management Console. The company also wants to enforce this policy using an SCP. Which TWO conditions must be met for the SCP to be effective?

Select 2 answers

A.The SCP must use a condition that checks if MFA is present.

B.The SCP must use the condition key 'aws:SourceIp' to allow only MFA-enabled IPs.

C.The SCP must require users to register MFA devices before accessing the console.

D.The SCP must be attached to the root organizational unit to apply to all accounts.

E.The SCP must be attached to individual IAM users.

AnswersA, D

The SCP uses aws:MultiFactorAuthPresent to check MFA status.

Why this answer

Options A and D are correct. The SCP must use a condition key such as `aws:MultiFactorAuthPresent` to deny access if the user has not authenticated with MFA (A), and it must be attached to the root organizational unit to apply to all accounts in the organization (D). Option B is incorrect because `aws:SourceIp` is for IP-based restrictions, not MFA.

Option C is incorrect because SCPs cannot require MFA registration; they can only enforce conditional access. Option E is incorrect because SCPs are attached to organizational units, not individual IAM users.

Full explanation →

205

Multi-Selectmedium

A security engineer is implementing a data classification policy for an S3 bucket that contains sensitive customer data. The policy requires that all objects be encrypted at rest using AWS KMS and that any attempt to upload an unencrypted object be denied. Which THREE steps should the engineer take to enforce this policy? (Choose THREE.)

Select 3 answers

A.Enable S3 bucket keys to reduce KMS API calls.

B.Create a customer managed KMS key.

C.Enable bucket policy to enforce SSL (aws:SecureTransport).

D.Add a bucket policy that denies PutObject if s3:x-amz-server-side-encryption is not aws:kms.

E.Enable S3 default encryption with the KMS key.

AnswersB, D, E

Provides encryption key for S3.

Why this answer

To enforce encryption at rest using AWS KMS for all objects uploaded to an S3 bucket, the security engineer should:

Create a customer managed KMS key (option B) to have full control over the key, including rotation, access policies, and auditing.

Add a bucket policy that denies PutObject if the `s3:x-amz-server-side-encryption` header is not set to `aws:kms` (option D). This ensures any upload without KMS encryption is denied.

Enable S3 default encryption with the KMS key (option E) to automatically encrypt objects even if the upload request does not include encryption headers.

Option A (enabling bucket keys) is wrong because it reduces KMS API calls for already KMS-encrypted objects, but does not enforce encryption. Option C (enforcing SSL) addresses encryption in transit, not at rest, and thus does not meet the policy requirement.

Exam trap

A common trap is to confuse encryption in transit (SSL/TLS) with encryption at rest. The question explicitly asks about encryption at rest, so options related to SecureTransport are irrelevant.

Full explanation →

206

MCQhard

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to retain logs for 7 years to comply with regulatory requirements. The logs are accessed infrequently after the first 90 days. What is the MOST cost-effective way to meet these retention and access requirements?

A.Export logs from CloudWatch Logs to an S3 bucket, then use S3 Lifecycle policies to transition logs to S3 Glacier Deep Archive after 90 days.

B.Stream logs to an S3 bucket using Kinesis, then use S3 Lifecycle policies to transition logs to S3 Standard-IA after 90 days.

C.Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs Insights for queries.

D.Set a retention policy on the CloudWatch Logs log group to 7 years and use CloudWatch Logs lifecycle policies to transition to Amazon S3 Glacier.

AnswerA

Exporting log data from CloudWatch Logs to S3 via the CreateExportTask API is the native, recommended path for long-term archival. Once in S3, a lifecycle rule can transition objects from S3 Standard to S3 Glacier Deep Archive after 90 days, minimizing storage costs for data that is rarely, if ever, accessed while meeting the 7-year compliance requirement. This approach also lets you set a short retention on the original log group to avoid ongoing CloudWatch Logs storage fees after export completes.

Why this answer

Exporting logs from CloudWatch Logs to Amazon S3 and using S3 Lifecycle policies to transition them to S3 Glacier Deep Archive after 90 days is the most cost-effective solution. CloudWatch Logs storage costs are higher than S3, and Glacier Deep Archive offers the lowest storage cost for infrequently accessed data that must be retained for 7 years. This approach meets the retention requirement while minimizing costs for logs that are rarely accessed after the initial 90-day period.

Exam trap

The trap here is that candidates may incorrectly assume CloudWatch Logs can directly transition logs to Glacier via lifecycle policies, but CloudWatch Logs does not support lifecycle transitions to S3 storage classes; logs must first be exported to S3.

How to eliminate wrong answers

Option B is wrong because S3 Standard-IA is more expensive than Glacier Deep Archive for long-term archival storage, and streaming logs via Kinesis adds unnecessary cost and complexity when a direct export from CloudWatch Logs to S3 is available. Option C is wrong because retaining logs in CloudWatch Logs for 7 years is significantly more expensive than storing them in S3 Glacier Deep Archive, and CloudWatch Logs Insights queries incur additional costs for data scanning. Option D is wrong because CloudWatch Logs does not have lifecycle policies to transition logs directly to Amazon S3 Glacier; the correct mechanism is to export logs to S3 first and then use S3 Lifecycle policies to transition to Glacier storage classes.

Full explanation →

207

MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to prevent all users in the production account from disabling AWS CloudTrail or modifying its configuration. What is the MOST effective way to achieve this?

A.Use IAM policies to deny only cloudtrail:DeleteTrail for all users.

B.Enable CloudTrail log file validation and use AWS Config to detect changes.

C.Create an SCP in AWS Organizations that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, cloudtrail:UpdateTrail, and similar actions.

D.Attach an IAM permissions boundary to all IAM roles in the production account that denies CloudTrail modifications.

AnswerC

An SCP applied to the production account can deny specific CloudTrail actions across all principals, including the root user, providing effective prevention.

Why this answer

An SCP applied to the production account can deny specific CloudTrail actions across all principals in the account, including the root user. Option A is insufficient because denying only cloudtrail:DeleteTrail still allows other modifications like cloudtrail:StopLogging or cloudtrail:UpdateTrail. Option B is detective, not preventive, and does not stop users from making changes.

Option D, IAM permissions boundaries, are attached to IAM entities but do not apply to all users (e.g., the root user) and can be overridden by an explicit allow; SCPs provide stronger account-wide enforcement.

Full explanation →

208

MCQeasy

A company wants to monitor failed SSH login attempts to its EC2 instances. Which AWS service should be used to collect and analyze these logs?

A.VPC Flow Logs

B.Amazon CloudWatch Logs with the unified CloudWatch agent

C.AWS CloudTrail

D.AWS Config

AnswerB

The CloudWatch agent can collect OS logs and deliver them to CloudWatch Logs for analysis.

Why this answer

Amazon CloudWatch Logs with the unified CloudWatch agent is the correct choice because the agent can be configured to collect and forward system log files, such as /var/log/secure (Amazon Linux) or /var/log/auth.log (Ubuntu), which record SSH authentication attempts including failures. This allows centralized monitoring and analysis of failed SSH logins via CloudWatch Logs Insights or metric filters.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (network-level) with OS-level logs, or assume CloudTrail captures all activity including guest OS events, when in fact CloudTrail only records AWS API calls, not in-OS authentication logs.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) but do not log application-level events like SSH authentication failures. Option C is wrong because AWS CloudTrail records API calls made to the AWS control plane (e.g., EC2 RunInstances) but does not capture guest OS-level logs such as SSH login attempts. Option D is wrong because AWS Config tracks resource configuration changes and compliance, not operating system log events.

Full explanation →

209

MCQmedium

Refer to the exhibit. A CloudWatch Logs metric filter is configured. Which log event will trigger the filter to create a metric?

A."2023-01-01 12:00:00 ERROR Connection refused"

B."ERROR: Connection refused"

C."2023-01-01 12:00:00 WARNING Disk full"

D."2023-01-01 12:00:00 INFO Starting process"

AnswerB

This log event starts with 'ERROR:', which matches the metric filter pattern exactly, triggering the metric.

Why this answer

The metric filter pattern is configured to match log events that begin with the string 'ERROR:'. Option B starts with 'ERROR:', so it triggers the metric filter. Options A, C, and D start with a timestamp and do not match the pattern.

Exam trap

The trap is that the filter pattern may appear to require multiple tokens or a specific format, but in reality it can be a simple string match. Many candidates overthink the pattern syntax and fail to recognize that a single term can be a valid filter pattern.

Full explanation →

210

MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created accounts automatically have AWS CloudTrail enabled, with logs delivered to a centralized S3 bucket. Which solution meets these requirements with the least operational overhead?

A.Create an SCP that enables CloudTrail and enforces log delivery to the centralized S3 bucket.

B.Use AWS Trusted Advisor to check CloudTrail status and send alerts to the security team.

C.Create an SCP that denies actions to disable CloudTrail and modify the S3 bucket policy. Use AWS CloudFormation StackSets to deploy a CloudTrail trail in each account.

D.Use AWS Config rules with auto-remediation to enable CloudTrail in each account.

AnswerC

Correct: StackSets automate deployment of CloudTrail across accounts, and SCP prevents disabling.

Why this answer

The correct answer. SCPs cannot enable CloudTrail, but they can prevent disabling it and modifying the S3 bucket policy. To actually enable CloudTrail across all accounts with minimal overhead, AWS CloudFormation StackSets can deploy a CloudTrail trail in each account automatically.

Option A is incorrect because SCPs cannot enable services—they only deny or allow actions. Option B is incorrect because AWS Trusted Advisor only checks and alerts; it does not enforce configurations. Option D is incorrect because AWS Config rules with auto-remediation can work but involve more setup and overhead compared to using StackSets, which is purpose-built for deploying resources across multiple accounts.

Therefore, C provides the least operational overhead.

Full explanation →

211

MCQeasy

A company wants to centrally collect CloudTrail logs from multiple AWS accounts and enable real-time analysis. Which combination of services should be used?

A.CloudTrail, Amazon Kinesis Data Firehose, and Amazon Athena.

B.CloudTrail, Amazon S3, S3 Event Notifications, and AWS Lambda.

C.CloudTrail, Amazon CloudWatch Logs, and cross-account log subscription.

D.CloudTrail, Amazon S3, and Amazon Simple Queue Service (SQS).

AnswerB

This design works because CloudTrail delivers compressed log files as S3 objects, and S3 Event Notifications invoke Lambda for each new object. Lambda then unpacks the gzipped CloudTrail JSON, filters for key API activity, and writes normalized events to CloudWatch Logs or fires alerts, giving near-real-time analysis without managing servers or a streaming buffer. It is serverless, cost-effective, and tightly integrated with S3, making it the natural choice for a central log collection and analysis pipeline.

Why this answer

It enables centralized collection of CloudTrail logs from multiple accounts by delivering logs to a central S3 bucket, then using S3 Event Notifications to trigger a Lambda function for real-time analysis. This pattern allows near-instant processing of log events as they arrive, meeting the requirement for real-time analysis without polling or batching delays.

Exam trap

The trap here is that candidates often assume Kinesis Data Firehose or CloudWatch Logs are required for real-time analysis, but S3 Event Notifications with Lambda provide a simpler, cost-effective, and fully serverless solution for near-real-time processing of CloudTrail logs.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is designed for streaming data ingestion into destinations like S3 or Redshift, but it does not natively support cross-account CloudTrail log delivery or real-time analysis via Athena (which queries data at rest, not in real-time). Option C is wrong because cross-account log subscription to CloudWatch Logs requires CloudTrail to deliver logs to CloudWatch Logs, which incurs additional costs and does not inherently provide real-time analysis; it also lacks the event-driven trigger for immediate processing. Option D is wrong because Amazon SQS is a message queue service that would require additional components to process logs in real-time, and CloudTrail cannot directly deliver logs to SQS; this setup adds latency and complexity without a built-in processing trigger.

Full explanation →

212

MCQeasy

A company is using Amazon CloudWatch Logs to store application logs. The security team needs to ensure that logs are encrypted at rest using a customer-managed KMS key (CMK). What configuration is required?

A.Add a KMS key policy that allows CloudWatch Logs to use the key.

B.Associate the CMK with the CloudWatch Logs log group by specifying the key ARN in the log group's encryption configuration.

C.Enable default encryption on the S3 bucket used for log export with a CMK.

D.Configure the S3 bucket policy to require SSE-KMS for log delivery.

AnswerB

To encrypt a CloudWatch Logs log group with a customer-managed CMK, you must use the AssociateKmsKey operation (or the console's encryption settings) and pass the key ARN for the log group. Once associated, CloudWatch Logs uses that CMK to encrypt all log data written to the log group. This is the action that actually fulfills the requirement; no other configuration changes the encryption of the log group's stored data.

Why this answer

CloudWatch Logs supports server-side encryption with a customer-managed KMS key (CMK) by associating the key ARN with the log group. This is done via the CloudWatch Logs console, AWS CLI, or SDK using the `associate-kms-key` operation, which encrypts all log data at rest within that log group. The KMS key policy must also grant the CloudWatch Logs service principal (`logs.region.amazonaws.com`) permission to use the key, but the core configuration step is associating the key with the log group.

Exam trap

The trap here is that candidates confuse the necessary KMS key policy (Option A) with the actual configuration step of associating the key with the log group, or they mistakenly think that encrypting the S3 export destination (Options C or D) encrypts the logs within CloudWatch Logs itself.

How to eliminate wrong answers

Option A is wrong because while a KMS key policy that allows CloudWatch Logs to use the key is necessary, it is not sufficient on its own; the key must also be explicitly associated with the log group via encryption configuration. Option C is wrong because enabling default encryption on an S3 bucket with a CMK only affects objects stored in that bucket, not the CloudWatch Logs log group itself; log export to S3 is a separate feature and does not encrypt logs at rest within CloudWatch. Option D is wrong because configuring an S3 bucket policy to require SSE-KMS for log delivery only applies to logs exported to S3, not to the encryption of logs stored natively in CloudWatch Logs.

Full explanation →

213

MCQhard

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. The security engineer has set up a NAT gateway in a public subnet and updated the route tables accordingly. However, instances in the private subnets cannot reach the internet. The engineer checks the security group for the NAT gateway and finds that it allows all outbound traffic. What is the most likely cause of the issue?

A.The route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway.

B.The NAT gateway does not have an Elastic IP address assigned.

C.The security group for the NAT gateway does not allow inbound traffic from the private subnets.

D.The network ACL for the private subnet does not allow inbound HTTP/HTTPS traffic.

AnswerA

For instances in a private subnet to reach the internet through a NAT gateway, the subnet's route table must have a default route (0.0.0.0/0) with the NAT gateway as the target. If this route is missing, any outbound internet-bound traffic has no valid next hop and is dropped, causing the connectivity failure. After adding this route, ensure the NAT gateway itself is in a public subnet with an associated Elastic IP and that the public subnet's route table points 0.0.0.0/0 to an internet gateway. This is the most direct and common cause when private instances cannot access the internet.

Why this answer

The most likely cause is that the route table for the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT gateway. Without this route, traffic from private instances cannot reach the NAT gateway, and thus cannot access the internet. Option B is incorrect because a NAT gateway must have an Elastic IP assigned during creation, so it would not be missing.

Option C is incorrect because NAT gateways do not have security groups; they are managed by AWS and the security group concept does not apply. Option D is incorrect because network ACLs are stateless and must allow both inbound and outbound traffic, but the issue here is more likely with routing.

Exam trap

The trap is that the engineer focuses on a non-existent security group for the NAT gateway, while the real issue is the missing default route in the private subnet's route table. Candidates may incorrectly assume security groups apply to NAT gateways or overlook the route table configuration.

How to eliminate wrong answers

Option A is wrong because it is actually the most likely cause of the issue—the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway for internet access; without it, traffic cannot be directed to the NAT gateway. Option B is wrong because a NAT gateway requires an Elastic IP address to function; if it were missing, the NAT gateway would not be provisioned correctly, but the question states the NAT gateway is set up, implying an EIP is assigned. Option D is wrong because network ACLs are stateless and must allow both inbound and outbound traffic for ephemeral ports; however, the private subnet's network ACL typically allows outbound HTTP/HTTPS by default, and inbound traffic from the internet is not required for instances initiating outbound connections.

Full explanation →

214

MCQmedium

A security engineer notices that an S3 bucket containing sensitive logs is publicly accessible. Which service should be used to automatically remediate this by applying a bucket policy?

A.AWS Config

B.Amazon GuardDuty

C.AWS Trusted Advisor

D.AWS CloudTrail

AnswerA

AWS Config can evaluate rules and trigger automatic remediation actions.

Why this answer

AWS Config is the correct service because it can continuously monitor S3 bucket configurations and automatically remediate non-compliant resources using AWS Config Rules and AWS Systems Manager Automation documents. When a rule detects that an S3 bucket is publicly accessible, it can trigger an automatic remediation action, such as applying a bucket policy that denies all public access, without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Config's monitoring and remediation capabilities with GuardDuty's threat detection or Trusted Advisor's advisory checks, failing to recognize that only AWS Config supports automated, rule-based remediation actions.

How to eliminate wrong answers

Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC flow logs, DNS logs, and CloudTrail events to identify malicious activity, but it cannot automatically remediate S3 bucket policies. Option C is wrong because AWS Trusted Advisor provides best-practice recommendations and security checks, including S3 bucket permissions, but it does not have native automated remediation capabilities; it only generates alerts. Option D is wrong because AWS CloudTrail is a logging service that records API calls for auditing and does not have the ability to apply or modify bucket policies automatically.

Full explanation →

215

MCQeasy

Which AWS service can be used to detect and alert on suspicious network traffic patterns within a VPC, such as port scanning or unusual outbound traffic?

A.AWS WAF

B.Amazon GuardDuty

C.AWS Network Firewall

D.VPC Flow Logs

AnswerB

Amazon GuardDuty is a managed threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor VPC Flow Logs, DNS logs, and CloudTrail event logs. It identifies suspicious activity such as reconnaissance, credential compromise, or data exfiltration, and automatically generates findings that can trigger CloudWatch Events. GuardDuty is purpose-built to detect and alert on a wide range of security threats without requiring manual analysis or custom logic.

Why this answer

Amazon GuardDuty is a threat detection service that continuously monitors VPC Flow Logs, DNS logs, and CloudTrail events to identify suspicious network traffic patterns such as port scanning, unusual outbound traffic, and other malicious activities. It uses machine learning, anomaly detection, and integrated threat intelligence to generate security alerts without requiring manual rules or signatures.

Exam trap

The trap here is that candidates confuse VPC Flow Logs (a raw data source) with a detection service, or assume AWS Network Firewall's stateful inspection includes anomaly-based alerting, when in fact GuardDuty is the only service that provides automated threat detection and alerting for network patterns like port scanning and unusual outbound traffic.

How to eliminate wrong answers

Option A is wrong because AWS WAF is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting at the application layer (HTTP/HTTPS), not for detecting network-level anomalies like port scanning or unusual outbound traffic within a VPC. Option C is wrong because AWS Network Firewall is a stateful managed firewall that enforces network traffic rules (e.g., allow/deny based on IP, port, protocol) but does not perform threat detection or anomaly-based alerting for patterns like port scanning; it requires explicit rule configuration. Option D is wrong because VPC Flow Logs is a raw logging feature that captures metadata about IP traffic (e.g., source/destination IP, port, protocol) but does not analyze, detect, or alert on suspicious patterns; it only provides the data that services like GuardDuty consume.

Full explanation →

216

MCQmedium

A company wants to enforce that all IAM users in its AWS account use multi-factor authentication (MFA) for console login. Which action should be taken to ensure compliance?

A.Apply an SCP to the AWS account that mandates MFA for all users.

B.Create an IAM policy that denies access unless MFA is present and attach it to all IAM users.

C.Enable MFA on the root user and share credentials with all users.

D.Configure the account password policy to require MFA.

AnswerB

Correct: IAM policies can use conditions to require MFA for access.

Why this answer

The correct action is to create an IAM policy that denies access unless MFA is present and attach it to all IAM users. This policy uses a condition key like 'aws:MultiFactorAuthPresent' to block API calls when MFA is not used, effectively enforcing MFA for console login. Option A is incorrect because service control policies (SCPs) apply at the AWS Organizations level, not to individual IAM users, and cannot enforce MFA on console login.

Option C is wrong because sharing root user credentials violates security best practices and does not enforce MFA for each user. Option D is incorrect because AWS account password policies do not include an MFA requirement; they only manage password complexity and rotation.

Full explanation →

217

MCQeasy

A company wants to ensure that all API calls made to their AWS account are logged and immutable. They have enabled AWS CloudTrail and are delivering logs to an S3 bucket. The security team requires that logs cannot be deleted or modified by anyone, including the root user. What should they do?

A.Enable S3 Object Lock with Compliance retention mode on the bucket.

B.Enable MFA Delete on the S3 bucket.

C.Enable S3 Versioning on the bucket.

D.Add a bucket policy that denies s3:DeleteObject for all principals.

AnswerA

Compliance mode prevents any deletion even by root.

Why this answer

S3 Object Lock with retention mode Compliance prevents any user, including root, from deleting or overwriting objects. Option B is wrong because MFA Delete prevents deletion but requires additional authentication and can be disabled by root if they have MFA. Option C is wrong because versioning alone does not prevent deletion of versions; objects can still be deleted, though old versions are retained.

Option D is wrong because bucket policies can be changed by root, so a deny policy is not immutable.

Full explanation →

218

MCQhard

A security engineer is analyzing an IAM policy that is attached to a group. The policy is intended to allow users to manage their own credentials. However, users are reporting that they cannot change their password. The policy is: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["iam:ChangePassword", "iam:GetAccountPasswordPolicy"], "Resource": "*" } ] } What is the issue?

A.The policy does not include the iam:UpdateLoginProfile action.

B.The policy should be attached to the user instead of the group.

C.The policy is missing the iam:CreateLoginProfile action.

D.The policy resource is set to "*", but ChangePassword requires the resource to be the specific user ARN.

AnswerD

IAM enforces that ChangePassword must be scoped to the user's own ARN.

Why this answer

The ChangePassword action requires the resource ARN to be the specific user's ARN (e.g., arn:aws:iam::account-id:user/${aws:username}). Using a wildcard '*' causes the policy to fail because IAM validates the resource ARN against the user's own ARN. Options A and C are incorrect because the required action is iam:ChangePassword, not UpdateLoginProfile or CreateLoginProfile.

Option B is incorrect because the policy attachment to the group is not the issue; the resource restriction is the problem.

Full explanation →

219

Multi-Selecthard

A company is implementing a data protection strategy for its Amazon S3 bucket that contains sensitive data. The company requires that all objects be encrypted at rest using server-side encryption with a customer managed key (SSE-KMS). Additionally, the company wants to ensure that only a specific IAM role can decrypt objects. Which THREE actions should the company take?

Select 3 answers

A.Attach an IAM policy to the specific role that grants kms:Decrypt on the customer managed key

B.Create a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms

C.Use the default S3-managed key (SSE-S3) for encryption

D.Modify the KMS key policy to allow the specific IAM role to use the key for decryption

E.Use client-side encryption with a customer managed key

AnswersA, B, D

Allows decryption by that role.

Why this answer

To enforce SSE-KMS, use a bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms (option B). To control decryption, grant kms:Decrypt to the specific role via an IAM policy (option A) and modify the KMS key policy to allow that role (option D). Option C is incorrect because SSE-S3 does not use a customer managed key.

Option E is incorrect because client-side encryption is not S3 server-side encryption.

Full explanation →

220

Multi-Selecthard

A security engineer is designing a centralized logging solution for 10 AWS accounts. Which THREE AWS services should be used to aggregate, store, and analyze logs?

Select 3 answers

A.Amazon Kinesis Data Streams

B.AWS Organizations

C.Amazon Athena

D.Amazon CloudWatch Logs

E.Amazon S3

AnswersB, C, E

Organizations helps manage multiple accounts centrally.

Why this answer

AWS Organizations is correct because it provides a centralized management structure for multiple AWS accounts, enabling you to automatically enforce policies and aggregate logs from all member accounts into a central S3 bucket. Amazon S3 is the recommended service for storing large volumes of logs durably and cost-effectively. Amazon Athena enables you to run ad-hoc SQL queries directly on the logs stored in S3, providing a serverless analytics solution for log analysis without the need for complex ETL or infrastructure management.

Together, these three services form a complete solution: Organizations for aggregation, S3 for storage, and Athena for analysis.

Exam trap

The trap here is that candidates often select Amazon Kinesis Data Streams or Amazon CloudWatch Logs as the primary aggregation and storage service, overlooking that AWS Organizations is required to centrally manage log delivery from multiple accounts, and that S3 plus Athena provides the most scalable and cost-effective solution for long-term storage and ad-hoc analysis.

Full explanation →

221

MCQmedium

A security team notices that an S3 bucket containing sensitive data is publicly accessible. The bucket policy is as follows: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } ] } Which step should be taken to secure the bucket while maintaining access for authorized users?

A.Use AWS Config to automatically block all public access.

B.Create an IAM role with S3 access and assign it to the bucket.

C.Add a Deny statement for any IP address outside the corporate network.

D.Delete the public bucket policy and attach a new policy that allows access only through a VPC Endpoint.

AnswerD

Restricts access to the VPC endpoint.

Why this answer

Deleting the public bucket policy and attaching a new policy that allows access only through a VPC Endpoint ensures that the bucket is not publicly accessible and only authorized users within the VPC can access it. Option A is incorrect because using AWS Config to block public access does not by itself grant authorized users access; additional configuration is needed. Option B is incorrect because creating an IAM role and assigning it to the bucket does not override the existing public bucket policy; the bucket remains publicly accessible.

Option C is incorrect because adding a Deny statement for IP addresses outside the corporate network does not remove the existing Allow statement for all principals, and the Allow would still grant public access unless an explicit Deny overrides it, which is not guaranteed with this approach.

Full explanation →

222

MCQmedium

An organization wants to detect and alert on any IAM user that creates a new access key without using multi-factor authentication (MFA). What is the MOST efficient way to achieve this?

A.Create a CloudWatch Events rule that triggers on CreateAccessKey events, and check if the user's MFA status is inactive.

B.Analyze S3 server access logs to detect access key creation.

C.Enable AWS Config managed rule for IAM user MFA, which monitors if users have MFA enabled.

D.Use IAM Access Analyzer to monitor for unused access keys.

AnswerA

CloudTrail logs the event and CloudWatch Events can evaluate conditions in real time.

Why this answer

CloudWatch Events (now Amazon EventBridge) can capture the CreateAccessKey API call in real time, and a Lambda target can check the IAM user's MFA status via the GetLoginProfile or ListMFADevices API. This provides immediate detection and alerting without polling or log analysis, making it the most efficient approach for this specific requirement.

Exam trap

The trap here is that candidates confuse the AWS Config rule for 'IAM user MFA' (which only checks if MFA is enabled on the user account) with the ability to detect MFA usage during a specific API call, leading them to select Option C.

How to eliminate wrong answers

Option B is wrong because S3 server access logs are not designed to capture IAM API events like CreateAccessKey; they log object-level access to S3 buckets, not IAM user actions. Option C is wrong because the AWS Config managed rule for IAM user MFA only checks whether MFA is enabled on the user account at the time of evaluation, not whether MFA was used during a specific access key creation event. Option D is wrong because IAM Access Analyzer focuses on analyzing resource policies for unintended access, not on monitoring access key creation events or MFA usage.

Full explanation →

223

MCQeasy

A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?

A.Amazon S3

B.AWS Config

C.AWS CloudTrail

D.Amazon CloudWatch Logs

AnswerD

CloudWatch Logs can aggregate logs from multiple sources and accounts.

Why this answer

Amazon CloudWatch Logs is the correct service because it provides a centralized platform for collecting, monitoring, and analyzing log data from multiple AWS accounts and on-premises sources. It supports cross-account log aggregation via subscription filters and cross-account destinations, enabling real-time monitoring and alerting through CloudWatch Logs Insights and metric filters. This makes it the appropriate choice for the stated requirement of central log aggregation for monitoring and alerting.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which records API calls) with a log aggregation service, but CloudTrail is a log source, not a centralized aggregation and analysis platform like CloudWatch Logs.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not a log aggregation and analysis service; while logs can be stored in S3, it lacks native real-time monitoring, alerting, and query capabilities required for centralized analysis. Option B is wrong because AWS Config is a service for evaluating and auditing resource configurations against desired policies, not for collecting and analyzing logs from multiple sources. Option C is wrong because AWS CloudTrail is specifically designed to record API activity within an AWS account, but it does not aggregate logs from other services or accounts for centralized monitoring and alerting; it is a source of logs, not an aggregation platform.

Full explanation →

224

MCQeasy

A security engineer needs to monitor for unauthorized changes to security group rules in an AWS account. The engineer wants to receive real-time notifications when a security group rule is added, modified, or removed. Which AWS service should the engineer use to capture these API calls?

A.Amazon GuardDuty

B.AWS CloudTrail

C.VPC Flow Logs

D.AWS Config

AnswerB

CloudTrail records all API calls, including security group modifications.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including EC2 APIs such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupEgress, CreateSecurityGroup, and DeleteSecurityGroup. By enabling CloudTrail trail with management events and optionally data events for EC2, the security engineer can capture these API calls in near real-time and stream them to Amazon CloudWatch Logs or Amazon EventBridge to trigger notifications for unauthorized changes to security group rules.

Exam trap

The trap here is that candidates often confuse AWS Config's ability to detect configuration changes (like security group rule drift) with the real-time API call capture requirement, but AWS Config relies on CloudTrail for change notifications and has inherent latency, whereas CloudTrail directly captures the API call at the moment it occurs.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail management events for malicious activity, but it does not directly capture or provide real-time notifications for specific API calls like security group rule changes. Option C is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) at the network interface level, not API calls that modify security group rules. Option D is wrong because AWS Config is a configuration auditing and compliance service that evaluates resource configurations against rules and can detect drift, but it operates on a periodic or event-driven basis (typically minutes delay) and does not capture API calls in real-time; it relies on CloudTrail for change notifications.

Full explanation →

225

MCQhard

A company has a multi-account AWS organization with centralized logging in a Security account. The Security account contains an S3 bucket that stores CloudTrail logs from all member accounts. The bucket policy allows CloudTrail from member accounts to deliver logs. Recently, a security audit revealed that the bucket is publicly accessible. The security engineer must ensure that only authorized accounts can access the logs. The engineer updates the bucket policy to include a condition that restricts access to specific AWS accounts. However, after the change, member accounts report that CloudTrail is failing to deliver logs to the bucket. The bucket policy currently includes the following statement: { "Effect": "Allow", "Principal": "*", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::central-logs/*", "Condition": { "StringEquals": { "aws:SourceAccount": "111111111111" } } } The Security account ID is 222222222222. What is the MOST likely cause of the delivery failure, and what should the engineer do to fix it?

A.Modify the KMS key policy to allow CloudTrail to decrypt and re-encrypt logs if SSE-KMS is enabled.

B.Update the bucket ACL to grant the CloudTrail service write access, as CloudTrail requires both bucket policy and ACL permissions.

C.Change the Principal from "*" to the CloudTrail service principal to restrict access more tightly.

D.Create an IAM role in the Security account and configure member accounts to use that role for log delivery.

AnswerC

This is correct. Changing the Principal from `*` to the CloudTrail service principal allows the policy to match CloudTrail requests. The condition should additionally be updated to use `aws:SourceArn` for proper account restriction, but among the given options, this is the best fix.

Why this answer

The bucket policy's condition using `aws:SourceAccount` is not appropriate for CloudTrail. CloudTrail uses the service principal (`cloudtrail.amazonaws.com`) and the `aws:SourceAccount` key is not evaluated for service principals. The condition does not match, causing log delivery failures.

Changing the Principal from `*` to the CloudTrail service principal is a necessary step to properly scope the policy. However, the condition should also be changed to use `aws:SourceArn` or removed entirely. Among the options, option C is the most direct fix, while option B is incorrect because CloudTrail does not require bucket ACLs.

Options A and D are irrelevant to the issue.

Full explanation →

AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 151–225