Knowledge + Practice

AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 226–300

376 questions total · 6pages · All types, answers revealed

Take a mock exam Exam hub

Page 4 of 6

226

MCQeasy

A security engineer needs to ensure that all API calls made in an AWS account are captured and retained for auditing purposes. The engineer must be able to query the logs for specific user activity over the past 90 days. Which AWS service should the engineer use to meet these requirements?

A.AWS CloudTrail

B.Amazon VPC Flow Logs

C.Amazon CloudWatch Logs

D.AWS Config

AnswerA

AWS CloudTrail is the native API auditing service: it records user activity and API calls across the account as CloudTrail events, capturing the identity, source IP, timestamp, request parameters, and response elements. These events can be delivered to Amazon S3 for long-term retention and queried with Athena, or sent to CloudWatch Logs for alerting. To fully meet an "all API calls" requirement, both management and data events must be enabled across all regions.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity, source IP, request parameters, and response elements. By default, CloudTrail stores event history for the last 90 days, which can be queried via the Event History console or API, meeting the requirement to query logs for specific user activity over the past 90 days without additional configuration.

Exam trap

The trap here is that candidates may confuse CloudTrail's default 90-day Event History with the need to create a trail and store logs in S3, but the question explicitly states 'captured and retained for auditing purposes' and 'query the logs for specific user activity over the past 90 days,' which is exactly what the built-in Event History provides without additional configuration.

How to eliminate wrong answers

Option B is wrong because Amazon VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol) at the network interface level, not API calls or user activity, so they cannot be used to audit API-level actions. Option C is wrong because Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log files from various sources (e.g., applications, AWS services), but it does not natively capture all AWS API calls; CloudTrail logs must be explicitly sent to CloudWatch Logs for that purpose, and the requirement is for a service that directly captures and retains API calls, not a downstream log destination. Option D is wrong because AWS Config evaluates and records resource configuration changes and compliance, not API calls; it tracks the state of resources over time but does not capture the API requests that caused those changes.

Full explanation →

227

MCQhard

A company is designing a shared services VPC architecture with multiple VPCs connected via a transit gateway. The security engineer needs to ensure that all traffic between VPCs is inspected by a centralized firewall appliance deployed in the shared services VPC. What configuration is required?

A.Create VPC peering connections between each VPC and the shared services VPC.

B.Configure transit gateway route tables to route all inter-VPC traffic through the firewall appliance.

C.Use security groups to route traffic through the firewall.

D.Deploy a Gateway Load Balancer (GWLB) in the shared services VPC and register the firewall as a target.

AnswerB

A transit gateway with carefully designed route tables is the standard way to enforce centralized inspection: attach all VPCs to the transit gateway, then configure a route in each spoke VPC's propagation that sends inter-VPC destination CIDRs to the firewall appliance's elastic network interface in the shared services VPC. The firewall inspects and forwards the traffic back to the transit gateway, which delivers it to the destination VPC. This enables deterministic, high-availability routing through the security appliance.

Why this answer

A transit gateway can use separate route tables to control traffic flow. By configuring the transit gateway route tables to point the default route (0.0.0.0/0) or specific inter-VPC CIDR ranges to a network interface of the centralized firewall appliance in the shared services VPC, all traffic between VPCs is forced through the firewall for inspection. This design ensures that the firewall acts as a central inspection point without requiring VPC peering or complex routing.

Exam trap

The trap here is that candidates often confuse the role of a Gateway Load Balancer (GWLB) with routing, assuming that deploying a GWLB alone will automatically route traffic through the firewall, when in fact the transit gateway route tables must be explicitly configured to direct traffic to the GWLB endpoint or the firewall ENI.

How to eliminate wrong answers

Option A is wrong because VPC peering connections do not support transitive routing; each peering connection is a one-to-one link, so traffic between two peered VPCs cannot be routed through a third VPC without additional complex routing and would not force inspection through the firewall. Option C is wrong because security groups are stateful virtual firewalls that control traffic at the instance level based on rules, not routing; they cannot route traffic through a separate appliance or enforce traffic inspection paths. Option D is wrong because a Gateway Load Balancer (GWLB) is used to distribute traffic to a fleet of third-party appliances (e.g., firewalls) for inline inspection, but it does not by itself route inter-VPC traffic through the firewall; the transit gateway route tables must still be configured to direct traffic to the GWLB endpoint, making this an incomplete solution without the correct routing configuration.

Full explanation →

228

MCQeasy

A company wants to grant a third-party auditor read-only access to specific CloudTrail log files stored in an S3 bucket. The auditor should not be able to list or access any other objects in the bucket. What is the most secure way to achieve this?

A.Use CloudTrail's built-in console access for the auditor.

B.Create a new IAM user for the auditor with an S3 policy that grants s3:GetObject on the entire bucket.

C.Generate pre-signed URLs for the specific log files and share them with the auditor.

D.Use a bucket policy that grants the auditor's IAM user s3:GetObject access to the specific log file prefix.

AnswerC

Pre-signed URLs provide time-limited access to specific objects without requiring AWS credentials.

Why this answer

Using S3 pre-signed URLs grants time-limited access to specific objects without requiring the auditor to have AWS credentials. Option A is wrong because CloudTrail does not provide built-in console access for auditors. Option B is wrong because granting s3:GetObject on the entire bucket would allow access to all objects, not just specific log files.

Option D is wrong because a bucket policy granting s3:GetObject to a specific prefix still requires the auditor to have AWS credentials, and the policy must explicitly deny s3:ListBucket to prevent listing; even then, managing credentials for a third party is less secure than using pre-signed URLs.

Full explanation →

229

MCQhard

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The security team needs to monitor for unauthorized changes to security groups. They have enabled AWS Config with the security-group-change detection rule. However, they notice that changes are being detected but not all changes trigger a notification. The team wants to ensure that every security group modification (create, delete, or rule change) sends an alert to the security operations center via Amazon SNS. The current setup: AWS Config rules evaluate resources periodically, and SNS notifications are sent only when the rule compliance status changes. What should the team do to achieve real-time alerts for all security group changes?

A.Deploy Amazon GuardDuty and enable the Security Group Monitoring feature.

B.Configure an Amazon EventBridge rule that matches API calls via CloudTrail for security group modifications and sends notifications to an SNS topic.

C.Increase the frequency of AWS Config rule evaluations to every minute to reduce detection latency.

D.Enable VPC Flow Logs and set up a metric filter for security group-related traffic anomalies.

AnswerB

CloudTrail logs all API calls, including security group modifications, in real time. An EventBridge rule can match these events and trigger an SNS notification, ensuring immediate alerts for every change.

Why this answer

CloudTrail logs all API calls, including security group modifications, in real time. By creating an Amazon EventBridge rule that matches SecurityGroup events and targets an SNS topic, the team can receive immediate notifications. Option A is incorrect because GuardDuty focuses on threat detection (e.g., suspicious API activity), not on monitoring all security group configuration changes.

Option C is incorrect because even with frequent evaluations, AWS Config rules evaluate configuration snapshots periodically and do not provide real-time alerting for each change. Option D is incorrect because VPC Flow Logs monitor network traffic, not security group modifications.

Full explanation →

230

Multi-Selecthard

A company has an AWS Organization with hundreds of accounts. The security team wants to enforce that no account can disable AWS CloudTrail logging. Which TWO approaches can achieve this?

Select 2 answers

A.Enable CloudTrail as a trusted service and create an organization trail.

B.Apply an IAM policy to each account's root user to prevent disabling CloudTrail.

C.Create an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.

D.Use AWS Config to automatically re-enable CloudTrail if it is disabled.

E.Configure CloudWatch Logs to monitor CloudTrail logs and alert if logging stops.

AnswersA, C

Organization trails cannot be stopped or deleted by member accounts.

Why this answer

Options A and C are correct. An SCP can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions (C), and enabling CloudTrail as a trusted service with an organization trail (A) prevents individual accounts from stopping or modifying the trail. Option B is wrong because IAM policies are account-specific and cannot be enforced across all accounts.

Option D is wrong because AWS Config can detect and remediate, but cannot prevent the initial disabling. Option E is wrong because CloudWatch Logs alerts do not prevent disabling CloudTrail.

Full explanation →

231

MCQhard

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security team wants to ensure that only traffic from the ALB reaches the EC2 instances, and that instances cannot initiate outbound connections to the internet. Which combination of security group rules should be implemented? (Select TWO.)

A.Inbound rule: Allow HTTP/HTTPS from 0.0.0.0/0.

B.Inbound rule: Allow HTTP/HTTPS from the ALB's security group.

C.Outbound rule: Allow all traffic to the ALB's security group only.

D.Outbound rule: Deny all traffic to 0.0.0.0/0.

E.Outbound rule: Allow all traffic to 0.0.0.0/0.

AnswerB, D

This ensures only ALB traffic reaches the instances.

Why this answer

Referencing the ALB's security group as the source for inbound HTTP/HTTPS traffic ensures that only traffic that has passed through the ALB can reach the EC2 instances. This leverages security group chaining, where the ALB's security group acts as a trusted source, preventing direct internet access to the instances. Option D is correct because a deny-all outbound rule to 0.0.0.0/0 blocks all outbound internet connections, satisfying the requirement that instances cannot initiate outbound connections.

Exam trap

The trap here is that candidates often confuse stateful security group behavior with stateless network ACLs, mistakenly thinking that a deny-all outbound rule will block return traffic for inbound connections, or they incorrectly assume that allowing outbound traffic to the ALB's security group is sufficient to prevent internet access.

How to eliminate wrong answers

Option A is wrong because allowing HTTP/HTTPS from 0.0.0.0/0 would permit direct internet traffic to the EC2 instances, bypassing the ALB and violating the security requirement. Option C is wrong because outbound rules in security groups are stateful; allowing traffic to the ALB's security group is unnecessary and does not prevent outbound internet connections—stateful return traffic is automatically allowed, but outbound-initiated traffic to the internet would still be permitted unless explicitly denied. Option E is wrong because allowing all outbound traffic to 0.0.0.0/0 would permit instances to initiate outbound connections to the internet, directly contradicting the requirement.

Full explanation →

232

MCQhard

An organization has a requirement to retain all AWS CloudTrail logs for at least 7 years for compliance. Currently, logs are stored in an S3 bucket with default settings. What is the MOST cost-effective way to meet the retention requirement?

A.Use S3 Glacier Deep Archive immediately.

B.Set an S3 lifecycle policy to delete objects after 7 years.

C.Set the CloudTrail trail to store logs in an S3 bucket with 7-year retention.

D.Configure S3 lifecycle policy to transition objects to S3 Glacier after 30 days and expire after 7 years.

AnswerD

Transitioning to Glacier reduces cost while meeting retention.

Why this answer

The most cost-effective because it uses an S3 lifecycle policy to transition objects to S3 Glacier after 30 days (reducing storage costs for older logs) and then expires (deletes) them after 7 years to meet the retention requirement. Option A is wrong because storing logs directly in S3 Glacier Deep Archive is not cost-effective for logs that may be accessed occasionally and does not automatically expire after 7 years without additional policy. Option B is wrong because simply deleting after 7 years does not take advantage of cheaper storage tiers.

Option C is wrong because CloudTrail trails do not have a retention setting; retention must be managed via S3 lifecycle policies.

Full explanation →

233

MCQeasy

A security engineer needs to detect and respond to potential credential theft where an IAM user's access key is being used from an unusual geographic location. Which AWS service should be used to generate alerts based on this anomaly?

A.AWS IAM Access Analyzer

B.AWS CloudTrail

C.Amazon GuardDuty

D.AWS Config

AnswerC

Amazon GuardDuty is a continuous threat detection service that consumes CloudTrail management and data events, VPC flow logs, and DNS logs, then applies anomaly detection and threat intelligence to identify suspicious API activity and credential compromise. It uses machine learning to baseline normal behavior and can trigger findings for events like unusual login patterns, account compromises, or API calls made from known malicious IPs. This directly satisfies the requirement to detect and respond to potential behavioral threats, making it the correct choice.

Why this answer

Amazon GuardDuty is the correct choice because it is a threat detection service that uses machine learning and integrated threat intelligence to identify anomalous behavior, such as an IAM access key being used from an unusual geographic location. It specifically analyzes CloudTrail management and data events, VPC flow logs, and DNS logs to detect credential theft patterns like a new geolocation or an impossible travel scenario, and can trigger alerts via Amazon EventBridge or SNS for automated response.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail's logging capability with active threat detection, assuming that CloudTrail alone can generate alerts for geographic anomalies, when in reality it only provides raw logs that require additional analysis services like GuardDuty or custom solutions to detect and alert on such patterns.

How to eliminate wrong answers

Option A is wrong because AWS IAM Access Analyzer is designed to identify resources shared with external entities by analyzing resource-based policies, not to detect anomalous usage patterns like geographic anomalies in access key usage. Option B is wrong because AWS CloudTrail is a logging service that records API activity but does not perform real-time anomaly detection or generate alerts based on unusual geographic locations; it would require additional custom logic (e.g., Athena queries or Lambda functions) to analyze the logs for such patterns. Option D is wrong because AWS Config is a configuration management and compliance service that tracks resource configuration changes and evaluates rules, not a threat detection service capable of identifying credential theft or geographic anomalies in IAM user activity.

Full explanation →

234

MCQmedium

Refer to the exhibit. A security engineer applies the above bucket policy to an S3 bucket. What is the effect of this policy?

A.The policy has no effect because the condition is invalid

B.Objects without encryption headers are allowed

C.All objects must be encrypted with SSE-KMS

D.All objects must be encrypted with SSE-S3

AnswerD

Correct: The condition requires s3:x-amz-server-side-encryption to be AES256, which is SSE-S3.

Why this answer

The policy denies PutObject requests that do not include the x-amz-server-side-encryption header with value AES256, thus enforcing SSE-S3 encryption on all uploads. Therefore, all objects must be encrypted with SSE-S3. Option A is incorrect because the condition is valid.

Option B is incorrect because the policy denies unencrypted uploads, preventing objects without encryption headers. Option C is incorrect because the condition specifies AES256 (SSE-S3), not SSE-KMS.

Full explanation →

235

Multi-Selecteasy

A company needs to monitor for unauthorized changes to its Amazon S3 bucket policies. Which TWO services can be used together to achieve this? (Choose two.)

Select 2 answers

A.Amazon Route 53

B.AWS CloudTrail

C.VPC Flow Logs

D.AWS Config

E.Amazon SNS

AnswersD, E

Tracks configuration changes to S3 bucket policies.

Why this answer

AWS Config is correct because it provides continuous monitoring and evaluation of your AWS resource configurations, including S3 bucket policies. You can create AWS Config rules (e.g., s3-bucket-policy-grantee-check) to detect changes to bucket policies and trigger compliance evaluations. When a policy change is detected, AWS Config can invoke an SNS topic to send notifications, enabling real-time alerting for unauthorized modifications.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs API calls) with AWS Config (which monitors configuration state), leading them to select CloudTrail instead of Config, even though CloudTrail alone cannot trigger notifications for unauthorized changes without additional services like EventBridge or SNS.

Full explanation →

236

MCQmedium

A company has a requirement to retain CloudTrail logs for 7 years for compliance. The logs are stored in an S3 bucket. The security team needs to ensure that logs are not deleted before the retention period ends, even by users with full S3 permissions. Which action should be taken?

A.Enable MFA Delete on the bucket and require MFA for all delete operations.

B.Enable S3 Object Lock in Compliance mode on the bucket with a retention period of 7 years.

C.Enable S3 Versioning and set a lifecycle policy to expire noncurrent versions after 7 years.

D.Create a bucket policy that denies s3:DeleteObject for all users.

AnswerB

Compliance mode prevents any deletion, even by root.

Why this answer

S3 Object Lock in Compliance mode prevents any user, including the root user, from overwriting or deleting objects until the retention period expires. This meets the requirement to retain CloudTrail logs for 7 years, even against users with full S3 permissions, because Compliance mode cannot be bypassed or removed by any user.

Exam trap

The trap here is that candidates often choose MFA Delete (Option A) because it adds security, but they overlook that MFA Delete does not prevent deletion by authorized users who have MFA devices, whereas Object Lock in Compliance mode provides true immutability against all users.

How to eliminate wrong answers

Option A is wrong because MFA Delete only adds an extra authentication factor for delete operations but does not prevent deletion by users who have MFA credentials, so it cannot guarantee retention against all users. Option C is wrong because versioning with a lifecycle policy only expires noncurrent versions after 7 years, but current versions can still be deleted immediately by users with s3:DeleteObject permission, and lifecycle policies do not prevent direct deletion. Option D is wrong because a bucket policy that denies s3:DeleteObject for all users can be overridden by an explicit allow in an IAM policy or by the root user, and it does not protect against accidental or malicious deletion by users with full permissions who can modify the policy itself.

Full explanation →

237

MCQhard

A company has a VPC with multiple subnets. An EC2 instance in a private subnet needs to access an S3 bucket. Which configuration provides the most secure and efficient access?

A.Create an Interface VPC Endpoint for S3.

B.Create a Gateway VPC Endpoint for S3 and update the route table.

C.Route the traffic through a NAT Gateway to the internet.

D.Assign a public IP address to the EC2 instance and allow it to access S3 via internet.

AnswerB

Private and secure access to S3.

Why this answer

A Gateway VPC Endpoint for S3 provides private, secure access to S3 without traversing the internet, using AWS's internal network. It is more efficient than an Interface Endpoint for S3 because it does not incur hourly charges or require additional route table entries for each subnet, and it leverages prefix lists to route traffic directly to S3 via the route table. This configuration ensures the EC2 instance in the private subnet can access S3 without a NAT Gateway or public IP, maintaining security and minimizing data transfer costs.

Exam trap

The trap here is that candidates often confuse Interface VPC Endpoints (which are required for most AWS services) with Gateway VPC Endpoints (which are only for S3 and DynamoDB), leading them to choose the more expensive and complex Interface Endpoint for S3.

How to eliminate wrong answers

Option A is wrong because an Interface VPC Endpoint for S3 is not the most secure and efficient choice; it incurs hourly costs and requires additional security group management, while a Gateway Endpoint is free and simpler for S3 access. Option C is wrong because routing traffic through a NAT Gateway to the internet is less secure (traffic leaves AWS network) and less efficient (adds cost and latency) compared to a VPC Endpoint. Option D is wrong because assigning a public IP address to the EC2 instance exposes it to the internet, violating security best practices for private subnets, and requires internet gateway routing, which is neither secure nor efficient for S3 access.

Full explanation →

238

MCQeasy

A company wants to centralize security logs from multiple AWS accounts into a single S3 bucket. The logging accounts (e.g., security, production) each have their own CloudTrail trails. Which configuration is required to allow cross-account log delivery?

A.Create an IAM role in the destination account with write permissions and allow CloudTrail in source accounts to assume that role.

B.Use a customer-managed KMS key in the destination account and share it with the source accounts.

C.Create an S3 bucket policy in the destination account that allows the CloudTrail service principal to write objects.

D.Configure S3 bucket ACLs to grant write access to the source account IDs.

AnswerC

A bucket policy in the destination account is the only mechanism CloudTrail uses to authorize cross-account log delivery, so the policy must allow the CloudTrail service principal (cloudtrail.amazonaws.com) to perform s3:PutObject and s3:GetBucketAcl on the bucket. For additional security, restrict the policy with aws:SourceAccount or aws:SourceArn to a specific source account, and when SSE-KMS is enabled, also include kms:GenerateDataKey and kms:Decrypt in the policy.

Why this answer

CloudTrail cross-account log delivery requires the destination S3 bucket to have a bucket policy that explicitly grants the CloudTrail service principal (`cloudtrail.amazonaws.com`) permission to write objects (e.g., `s3:PutObject`). This allows CloudTrail in any source account to deliver logs directly to the bucket without needing IAM roles or shared credentials, as the service principal authenticates on behalf of the source account.

Exam trap

The trap here is that candidates often assume cross-account access requires an IAM role (Option A) or shared encryption keys (Option B), but AWS services like CloudTrail use service principals and bucket policies for cross-account log delivery, not IAM roles or ACLs.

How to eliminate wrong answers

Option A is wrong because CloudTrail does not assume an IAM role in the destination account; it uses the source account's CloudTrail service principal to write logs, and the bucket policy must grant access to that principal, not an IAM role. Option B is wrong because while a customer-managed KMS key can be used for encryption, it is not required for cross-account log delivery; the core requirement is the bucket policy, and sharing a KMS key alone does not enable CloudTrail to write logs. Option D is wrong because S3 bucket ACLs are not supported for granting cross-account write access to the CloudTrail service principal; bucket ACLs are legacy and cannot grant permissions to AWS service principals, only to AWS accounts or canonical user IDs.

Full explanation →

239

MCQeasy

A company wants to ensure that all data transmitted between its EC2 instances and an Application Load Balancer (ALB) is encrypted. Which configuration should be applied?

A.Install SSL certificates on each EC2 instance and configure the ALB to use TCP passthrough.

B.Configure the ALB with an HTTPS listener and a target group that uses HTTPS as the protocol.

C.Use a Network Load Balancer with TLS listeners and target groups.

D.Configure security groups to allow only HTTPS traffic.

AnswerB

This ensures traffic between ALB and instances is encrypted.

Why this answer

It establishes end-to-end encryption between clients and the ALB (via HTTPS listener) and between the ALB and EC2 instances (via HTTPS target group). This ensures that data transmitted over both legs of the connection is encrypted using TLS, meeting the requirement that all data between the EC2 instances and the ALB is encrypted.

Exam trap

The trap here is that candidates often confuse 'encryption in transit' with 'network access control' (security groups) or assume that any load balancer with TLS listeners guarantees encryption between the load balancer and targets, but only an ALB with HTTPS target groups re-encrypts traffic to the instances, while an NLB with TLS passthrough does not re-encrypt.

How to eliminate wrong answers

Option A is wrong because TCP passthrough does not terminate TLS at the ALB; instead, it forwards raw TCP traffic to the instances, which would require the instances to handle SSL termination themselves, and the ALB cannot inspect or re-encrypt the traffic, so the data between the ALB and instances may not be encrypted if the instances are not configured correctly. Option C is wrong because a Network Load Balancer with TLS listeners and target groups encrypts traffic between clients and the NLB, but the NLB does not re-encrypt traffic to targets; it passes the original TLS session through, so the data between the NLB and EC2 instances is still encrypted, but the question specifically asks for an ALB, not an NLB, and using an NLB would not meet the requirement to use an Application Load Balancer. Option D is wrong because security groups only control network access (allow/deny traffic) and do not enforce encryption; they can allow HTTPS traffic, but they do not ensure that the data is actually encrypted in transit.

Full explanation →

240

MCQmedium

An organization uses AWS Organizations and wants to centrally manage Amazon GuardDuty across multiple accounts. What is the correct architecture?

A.Enable GuardDuty only in the master account; it will automatically monitor all member accounts.

B.Use AWS CloudFormation StackSets to deploy GuardDuty in all accounts and regions.

C.Designate a delegated administrator account in Organizations and enable GuardDuty in that account.

D.Enable GuardDuty in each region separately and use cross-region aggregation.

AnswerC

The correct approach is to designate a delegated administrator account in AWS Organizations for GuardDuty. This delegated admin can enable GuardDuty for all member accounts, manage their detectors, and view aggregated findings centrally without needing per-account invitations. It is the only method that provides a single admin control plane over multi-account GuardDuty coverage and findings.

Why this answer

AWS Organizations allows you to designate a delegated administrator account for Amazon GuardDuty, which can then centrally manage GuardDuty across all member accounts in the organization. This architecture simplifies enabling GuardDuty and managing findings without needing to configure each account individually, as the delegated administrator can enable GuardDuty for all accounts in the organization from a single point.

Exam trap

The trap here is that candidates often assume enabling GuardDuty in the master account automatically covers all member accounts (Option A), but in reality, GuardDuty requires explicit member account management or a delegated administrator setup, and the delegated administrator model is the recommended architecture for centralized management in Organizations.

How to eliminate wrong answers

Option A is wrong because enabling GuardDuty only in the master account does not automatically monitor member accounts; GuardDuty must be explicitly enabled in each account, or a delegated administrator must be used to manage member accounts centrally. Option B is wrong because while AWS CloudFormation StackSets can deploy resources across accounts and regions, GuardDuty is a regional service that requires a centralized management approach via Organizations, and StackSets do not provide the native integration for cross-account threat detection management that a delegated administrator does. Option D is wrong because GuardDuty findings are regional by default, and cross-region aggregation is not a built-in feature; instead, you would need to use a delegated administrator to centrally view findings from multiple regions, but the correct architecture for multi-account management is through Organizations delegation, not separate per-region enablement.

Full explanation →

241

MCQmedium

A company is using Amazon EC2 instances in a VPC with a security group that allows inbound SSH from 0.0.0.0/0. A security engineer needs to restrict SSH access to only the company's public IP range (203.0.113.0/24) while maintaining all other existing rules. What is the MOST efficient way to accomplish this?

A.Disable SSH and use AWS Systems Manager Session Manager to connect to instances.

B.Create a network ACL with an inbound rule allowing SSH from 203.0.113.0/24 and deny all other traffic.

C.Modify the existing security group rule to change the source from 0.0.0.0/0 to 203.0.113.0/24.

D.Create a new security group rule allowing SSH from 203.0.113.0/24 and keep the existing rule.

AnswerC

Modifying the existing rule is the correct action because security group inbound rules are evaluated as an allow list, and changing the source to 203.0.113.0/24 removes the wildcard entry while authorizing only the specified IP range. The update is an in-place edit, so no duplicate rule remains and the stateful security group automatically permits the return traffic for established SSH sessions. The existing rule should be changed rather than appended because any remaining 0.0.0.0/0 rule would continue to allow all source IPs.

Why this answer

Modifying the existing security group rule's source from 0.0.0.0/0 to 203.0.113.0/24 directly restricts inbound SSH to the company's public IP range without affecting any other rules. Security groups are stateful and rule changes apply immediately, making this the most efficient approach as it requires only a single edit to the existing rule.

Exam trap

The trap here is that candidates may think adding a more specific allow rule overrides a broader allow rule, but security groups use an allow-list model where all rules are additive, so the original 0.0.0.0/0 rule must be removed or modified to actually restrict access.

How to eliminate wrong answers

Option A is wrong because disabling SSH and using AWS Systems Manager Session Manager is an alternative solution, not the most efficient way to restrict SSH access while maintaining existing rules; it changes the access method entirely and may not meet the requirement to restrict SSH specifically. Option B is wrong because network ACLs are stateless and operate at the subnet level, not the instance level; modifying a network ACL would affect all instances in the subnet and require separate inbound and outbound rules for return traffic, making it less efficient and not a direct replacement for a security group rule. Option D is wrong because adding a new security group rule allowing SSH from 203.0.113.0/24 while keeping the existing rule with 0.0.0.0/0 would still allow SSH from all IPs, as security group rules are evaluated as a logical OR; the existing permissive rule would remain in effect, failing to restrict access.

Full explanation →

242

MCQhard

A company uses AWS Organizations to manage 50 accounts. The security team has enabled AWS CloudTrail in the management account with an organization trail that delivers logs to a central S3 bucket. The bucket policy grants necessary permissions to CloudTrail. Recently, the security team noticed that logs from two member accounts stopped appearing in the bucket. Other accounts continue to deliver logs correctly. The CloudTrail status in the management account shows that the trail is logging and deliveries are succeeding. The security team checked the CloudTrail configuration in the affected member accounts and found that they do not have any trails configured. The IAM roles used for CloudTrail in the management account have sufficient permissions. What is the most likely cause of the missing logs?

A.The KMS key used for encryption does not include permissions for the member accounts.

B.The S3 bucket policy does not grant write access to the CloudTrail service for the affected member accounts.

C.The CloudTrail service-linked role in the member accounts is missing.

D.An SCP attached to the affected member accounts denies cloudtrail:PutLogEvents.

AnswerB

Correct: Bucket policy must allow CloudTrail from all accounts.

Why this answer

The most likely cause is that the S3 bucket policy does not grant write access to the CloudTrail service for the affected member accounts. When an organization trail is created, CloudTrail uses the management account's permissions to deliver logs to the S3 bucket. However, the bucket policy must explicitly allow the CloudTrail service principal from each member account to write logs.

If the policy only allows the management account, member accounts' logs will be rejected. Option A is incorrect because the issue is not about KMS key permissions; if SSE-KMS is used, the key policy must also grant decrypt permissions to CloudTrail, but the question does not mention KMS. Option C is incorrect because CloudTrail does not use a service-linked role for organization trails; it uses the CloudTrail service role in the management account.

Option D is incorrect because an SCP denying cloudtrail:PutLogEvents would affect all CloudTrail actions, but the logs from other accounts are still arriving, so it is unlikely.

Full explanation →

243

MCQmedium

A security engineer is designing a web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be protected from common web exploits like SQL injection and cross-site scripting. Which AWS service should be used to provide this protection?

A.AWS WAF

B.Network ACLs

C.Security Groups

D.AWS Shield Advanced

AnswerA

AWS WAF filters and monitors HTTP requests to protect against web exploits.

Why this answer

AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting. Network ACLs are stateless firewalls at the subnet level and do not inspect application-layer traffic. Security Groups are stateful firewalls at the instance level and do not provide application-layer filtering.

AWS Shield Advanced provides DDoS protection, not application-layer attack prevention.

Full explanation →

244

MCQhard

A company uses Amazon S3 to store sensitive data. The security team needs to be alerted when an S3 bucket policy is changed to allow public access. Which combination of services should be used to meet this requirement?

A.AWS CloudTrail and Amazon Simple Notification Service (SNS)

B.S3 server access logs and Amazon Athena

C.AWS Trusted Advisor and Amazon Simple Notification Service (SNS)

D.AWS Config with AWS Lambda and Amazon Simple Notification Service (SNS)

AnswerD

AWS Config can continuously record configuration changes to an S3 bucket policy and evaluate those changes against a managed or custom rule. When a PutBucketPolicy event occurs, AWS Config marks the configuration item as changed and invokes a custom Lambda function, which can in turn publish a message to an SNS topic to notify security teams. This design provides real-time detection and alerting because the Lambda function is triggered by the configuration change, not by a periodic scan.

Why this answer

AWS Config can monitor S3 bucket policies for changes that grant public access using a managed rule like 's3-bucket-public-read-prohibited' or a custom Lambda function. When a noncompliant change is detected, AWS Config can invoke an AWS Lambda function to evaluate the policy and publish a notification to Amazon SNS, alerting the security team. This combination provides real-time, policy-driven monitoring and alerting for public access changes.

Exam trap

The trap here is that candidates often choose AWS CloudTrail (Option A) because it logs API calls like PutBucketPolicy, but they overlook that CloudTrail alone cannot evaluate the policy content for public access or trigger alerts without additional services like EventBridge and Lambda, whereas AWS Config is purpose-built for continuous compliance monitoring and alerting.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail logs API calls but does not evaluate bucket policies for public access or trigger alerts directly; it would require additional services like Amazon EventBridge and Lambda to filter and act on specific events, making it less direct than AWS Config. Option B is wrong because S3 server access logs record object-level requests (e.g., GET, PUT) and are not designed to monitor or alert on bucket policy changes; Athena is used for querying logs, not for real-time alerting. Option C is wrong because AWS Trusted Advisor checks for publicly accessible S3 buckets but only provides periodic checks (not real-time) and does not trigger alerts via SNS automatically for policy changes; it requires manual review or custom automation.

Full explanation →

245

MCQeasy

A company has a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which component should be added to the VPC to enable this?

A.Internet gateway

B.VPN connection

C.VPC peering connection

D.NAT gateway

AnswerD

A NAT gateway enables outbound internet access for private subnets.

Why this answer

(NAT gateway). A NAT gateway enables instances in a private subnet to initiate outbound traffic to the internet for tasks like software updates, while preventing inbound traffic from the internet. Option A (Internet gateway) is incorrect because it is used for public subnets to allow direct internet access.

Option B (VPN connection) is used for secure connectivity to an on-premises network, not for outbound internet access. Option C (VPC peering connection) is used to connect two VPCs, not to provide internet access.

Full explanation →

246

MCQhard

A security engineer is investigating a potential data exfiltration from an Amazon S3 bucket. The bucket policy allows access to a specific IAM role, but the engineer suspects that the role has been compromised. The engineer wants to quickly block all access to the bucket without deleting the bucket or the policy. What is the BEST course of action?

A.Delete the IAM role that is allowed access to the bucket.

B.Use AWS WAF to block the IP addresses of the compromised role.

C.Modify the bucket policy to deny all principals.

D.Add a bucket policy statement that denies access unless the request comes from a specific IP address that does not exist.

AnswerD

A deny condition with an impossible IP address blocks all access effectively.

Why this answer

Adding a bucket policy statement that denies access unless the request originates from a specific IP address that does not exist effectively blocks all traffic to the bucket. This approach leverages the explicit deny in AWS IAM policy evaluation logic, which overrides any allow, and does not require deleting the bucket or the existing policy. It provides an immediate, reversible block without altering the original policy structure or the IAM role.

Exam trap

The trap here is that candidates may think modifying the bucket policy to deny all principals (Option C) is acceptable, but the question explicitly forbids deleting the policy, and modifying it to deny all principals is a form of policy deletion; the correct approach uses a conditional deny with an impossible condition to avoid altering the original policy structure.

How to eliminate wrong answers

Option A is wrong because deleting the IAM role would permanently remove the role and its permissions, which is not reversible and may break other dependencies; the question requires blocking access without deleting the bucket or policy. Option B is wrong because AWS WAF is a web application firewall that operates at the application layer (HTTP/HTTPS) and cannot directly block S3 API requests, which use AWS Signature Version 4 and are not HTTP requests that WAF can inspect. Option C is wrong because modifying the bucket policy to deny all principals would require editing the existing policy, which the question explicitly prohibits; it also does not meet the requirement to avoid deleting the policy.

Full explanation →

247

MCQeasy

A company uses AWS CloudTrail to log data events for S3 buckets. They notice that some S3 object-level API calls are not being logged. Which configuration could be the cause?

A.The trail is not configured to log data events for the S3 bucket.

B.The trail is configured to log management events only.

C.The trail is using a CloudWatch Logs log group for delivery.

D.The trail is configured to log read events only.

AnswerA

Data events must be enabled for S3 object-level logging.

Why this answer

CloudTrail trails must be explicitly configured to log data events for S3 buckets. Data events are high-volume operations (e.g., GetObject, PutObject, DeleteObject) and are not captured by default. If the trail is not configured to log data events for the specific S3 bucket, those object-level API calls will not appear in the CloudTrail logs.

Exam trap

The trap here is that candidates often confuse management events (which are logged by default) with data events (which require explicit configuration), leading them to incorrectly assume that all S3 API calls are automatically captured by CloudTrail.

How to eliminate wrong answers

Option B is wrong because management events (e.g., CreateBucket, DeleteBucket) are logged by default, but they do not include object-level API calls; object-level calls are data events, which require separate configuration. Option C is wrong because delivering logs to a CloudWatch Logs log group is a delivery destination option and does not affect which events are logged; it only changes where logs are sent. Option D is wrong because configuring the trail to log read events only would still capture read data events (e.g., GetObject) but not write data events (e.g., PutObject); the question states that some object-level API calls are not being logged, which could be due to not logging data events at all, not just a read/write filter.

Full explanation →

248

MCQmedium

A company is designing a data protection strategy for its Amazon RDS for PostgreSQL database. The database contains sensitive customer data. Compliance requirements mandate that all backups be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

A.Create an encrypted read replica of the RDS instance and use the replica for backups.

B.Use S3 server-side encryption with a customer managed key for automated backups. Configure lifecycle policies to rotate the key.

C.Enable encryption at rest on the RDS instance using an AWS managed KMS key. The key will be rotated automatically every year.

D.Enable encryption at rest on the RDS instance using a customer managed KMS key. Enable automatic key rotation in KMS.

AnswerD

Customer managed KMS key allows you to enable automatic annual rotation.

Why this answer

Enabling encryption at rest on the RDS instance using a customer managed KMS key and enabling automatic key rotation in KMS provides annual key rotation, satisfying the compliance requirement. Option A is incorrect because an encrypted read replica inherits the source instance's encryption key and does not provide independent backup encryption or key rotation. Option B is incorrect because S3 server-side encryption is not relevant to RDS automated backups; RDS encrypts backups using the KMS key associated with the DB instance, and S3 lifecycle policies rotate objects, not encryption keys.

Option C is incorrect because although an AWS managed KMS key encrypts the RDS instance and backups, its automatic key rotation occurs every three years, not annually as required.

Full explanation →

249

MCQeasy

A security engineer is configuring a new VPC with public and private subnets. The application servers in the private subnet need to download patches from the internet. Which component is required?

A.VPC endpoint

B.Direct Connect

C.Internet gateway

D.NAT gateway

AnswerD

A NAT gateway is a managed AWS service that enables instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates or API calls) while preventing unsolicited inbound connections. It is deployed in a public subnet with an Elastic IP address, and the private subnet's route table sends non-local traffic to the NAT gateway's network interface. This exactly matches the requirement to provide outbound internet access for private subnet instances without exposing them to inbound traffic.

Why this answer

A NAT gateway is required to allow instances in a private subnet to initiate outbound traffic to the internet (e.g., to download patches) while preventing the internet from initiating inbound connections to those instances. The NAT gateway resides in a public subnet with an attached Internet Gateway, and it translates the private IP addresses of the application servers to the NAT gateway's Elastic IP address for outbound traffic.

Exam trap

The trap here is that candidates often confuse a NAT gateway with an Internet Gateway, mistakenly thinking an Internet Gateway can be attached directly to a private subnet, but an Internet Gateway only works with resources that have public IP addresses, whereas a NAT gateway enables outbound internet access for private instances without public IPs.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint (e.g., Gateway or Interface endpoint) provides private connectivity to AWS services (like S3 or DynamoDB) without traversing the internet, but it does not provide general internet access for downloading patches from arbitrary internet hosts. Option B is wrong because Direct Connect establishes a dedicated private network connection from on-premises to AWS, but it does not inherently provide internet access; it would require additional routing and an internet gateway to reach the public internet. Option C is wrong because an Internet Gateway alone enables bidirectional communication between the VPC and the internet, but it cannot be directly attached to a private subnet; instances in a private subnet without a public IP cannot use an Internet Gateway for outbound-only traffic.

Full explanation →

250

MCQmedium

A healthcare company stores sensitive patient data in Amazon S3. The security team has implemented a data protection strategy that includes S3 default encryption using SSE-KMS with a customer managed key. They also use S3 Object Lock to prevent deletion. Recently, an administrator accidentally deleted the KMS key used for encryption. As a result, all objects in the bucket are now inaccessible. The company has a backup of the key material but does not have the original key ID. Which action should the team take to restore access to the data?

A.Use the backup key material directly in an application to decrypt objects without KMS.

B.Import the key material into a new KMS key and re-encrypt all objects using S3 Batch Operations.

C.Create a new KMS key with the same key ID using the backup material.

D.Restore the deleted KMS key from the CloudHSM backup.

AnswerB

You can create a new key and re-encrypt objects, but you need the original key material to decrypt first.

Why this answer

When a KMS key is deleted and you have a backup of the key material, you can import that material into a new KMS key. Even though the new key has a different key ID, because the cryptographic material is identical, it can decrypt the data keys that were encrypted with the original key. S3 Batch Operations can then re-encrypt all objects under the new key, restoring access.

Option A is incorrect because the objects were encrypted with SSE-KMS, meaning the data key itself is encrypted by KMS and cannot be decrypted without the KMS key. Option C is incorrect because KMS does not allow you to specify the key ID when creating a new key; AWS generates a unique key ID. Option D is incorrect because CloudHSM is a separate service for generating and storing keys; it is not used to back up KMS keys.

Full explanation →

251

MCQeasy

A company has a single AWS account with multiple IAM users. The administrator created an IAM policy that allows all users to launch EC2 instances, but only if they use a specific AMI ID (ami-12345678) and a specific instance type (t3.micro). The policy uses a condition that checks the EC2 instance type and AMI ID. However, a user is able to launch an EC2 instance with a different AMI ID and a larger instance type. The administrator reviews the policy and confirms that the condition is correctly written. What is the most likely reason that the policy is not working as expected?

A.The condition keys used (ec2:InstanceType and ec2:ImageId) are not supported for the RunInstances action in IAM policies.

B.The policy is attached to the user but must also be attached to the IAM group.

C.The policy does not include an explicit deny statement for non-compliant launches.

D.The condition is written incorrectly; it should use StringLike instead of StringEquals.

AnswerC

In IAM, the default behavior is to deny access, but that default is overridden by any applicable allow statement from another policy. This policy only allows RunInstances when the specified condition keys match; it does not explicitly deny RunInstances when the conditions are not met. Consequently, if the user has any other identity-based or resource-based policy that allows RunInstances without conditions, the user can still launch non-compliant instances. An explicit Deny statement using a condition like StringNotEquals (or a NotCondition) would be required to block those non-compliant launches, making the missing deny the root cause.

Why this answer

The most likely reason is that the user has another IAM policy attached (e.g., a managed policy or group policy) that allows ec2:RunInstances without the condition. IAM evaluates all policies; if any allow statement grants the action, the action is permitted unless explicitly denied. The conditional allow only restricts when that specific statement is used, but a separate unconditional allow overrides the condition.

Adding an explicit deny for non-compliant launches would block them regardless of other policies.

Exam trap

Candidates often assume that adding a condition to an allow statement is sufficient to restrict actions, but if another allow statement without the condition exists, the condition is ineffective. An explicit deny is required to override other allows.

How to eliminate wrong answers

Option B is wrong because attaching a policy to an IAM group is not required for it to take effect; policies attached directly to a user are fully evaluated and do not need group attachment to work. Option C is wrong because an explicit deny statement is not needed; IAM policies are deny-by-default, so an allow with a condition that fails results in an implicit deny, but the condition keys are unsupported, so the condition is ignored and the allow applies broadly. Option D is wrong because the condition key issue is not about the operator (StringEquals vs StringLike); even if StringLike were used, the unsupported condition keys would still be ignored, so the policy would still not restrict the launch.

Full explanation →

252

MCQhard

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket via a VPC endpoint. The bucket policy allows access only from the VPC endpoint. The instance has an IAM role that grants s3:GetObject on the bucket. The EC2 instance receives an AccessDenied error. What is the most likely cause?

A.The IAM role does not have sufficient permissions.

B.The bucket policy does not include the aws:SourceVpce condition.

C.The VPC endpoint policy is blocking the request.

D.The EC2 instance's security group does not allow outbound traffic to S3.

AnswerB

Without this condition, the bucket policy that restricts to VPC endpoint may not match the request, causing AccessDenied.

Why this answer

The AccessDenied error occurs because the S3 bucket policy must include the aws:SourceVpce condition to allow access from the specific VPC endpoint. Without this condition, the bucket policy denies all requests that do not originate from the endpoint, regardless of IAM permissions. Option B is correct because the missing condition is the most likely cause.

Full explanation →

253

MCQhard

A company has a CloudTrail trail that logs management events for all regions in the management account. They want to also log data events for all S3 buckets in the organization. Which configuration change will meet this requirement with the LEAST operational overhead?

A.Use Amazon EventBridge to capture S3 events and forward them to CloudTrail.

B.Enable S3 server access logs for all buckets and aggregate them using Athena.

C.Create a new trail in each member account to log S3 data events and deliver to a central S3 bucket.

D.Modify the existing trail to add an event selector for S3 data events with a scope of all buckets.

AnswerD

Organization trails can log data events for all S3 buckets across the organization with a single configuration.

Why this answer

CloudTrail trails can be configured with an event selector that includes data events for S3, and setting the scope to 'all buckets' logs data events for every S3 bucket in the account without needing separate configurations. This approach reuses the existing management trail, minimizing operational overhead by avoiding additional trails, services, or aggregation steps.

Exam trap

The trap here is that candidates may think data events require separate trails or external services like EventBridge, but CloudTrail's built-in event selector for S3 data events with an 'all buckets' scope directly meets the requirement with minimal overhead.

How to eliminate wrong answers

Option A is wrong because Amazon EventBridge captures S3 events (e.g., object-level notifications) but does not natively forward them to CloudTrail; CloudTrail ingests S3 data events directly via its own event selectors, not through EventBridge, and using EventBridge would add unnecessary complexity and cost. Option B is wrong because S3 server access logs provide detailed access records but are not CloudTrail data events; they require separate setup per bucket, aggregation via Athena, and do not integrate with CloudTrail's centralized logging, increasing operational overhead. Option C is wrong because creating a new trail in each member account duplicates effort and requires managing multiple trails, whereas CloudTrail can log S3 data events across all accounts in an organization from the management account using a single trail with the appropriate event selector.

Full explanation →

254

Multi-Selectmedium

A company is deploying a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The security engineer needs to protect the application from common web exploits such as SQL injection and cross-site scripting. Which TWO services can be used together to achieve this? (Choose TWO.)

Select 2 answers

A.Amazon GuardDuty

B.AWS Shield Advanced

C.Network ACLs

D.AWS WAF

E.Amazon CloudFront

AnswersB, D

Shield Advanced provides advanced DDoS protection and integrates with WAF.

Why this answer

AWS WAF (Option D) can be associated with an ALB to filter web requests and protect against common exploits like SQL injection and cross-site scripting. AWS Shield Advanced (Option B) provides enhanced DDoS protection and integrates with WAF for additional layer 7 protections. Option A is wrong because GuardDuty is a threat detection service, not an inline web application firewall.

Option C is wrong because Network ACLs operate at the subnet level and do not provide application-layer filtering. Option E is wrong because CloudFront is a CDN, and while it can be used with WAF, it alone does not provide WAF rules.

Full explanation →

255

MCQeasy

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which AWS service or feature should be used to achieve this?

A.AWS Key Management Service (KMS)

B.Amazon S3 server-side encryption

C.RDS encryption feature

D.SSL/TLS certificates

AnswerA

KMS provides encryption keys for RDS encryption.

Why this answer

AWS Key Management Service (KMS) is the correct service because Amazon RDS for MySQL uses KMS-managed customer master keys (CMKs) to enable encryption at rest for DB instances. When you enable RDS encryption, RDS automatically integrates with KMS to encrypt the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption. This is the foundational service that provides the key management and encryption operations for RDS at-rest encryption.

Exam trap

The trap here is that candidates confuse the RDS encryption feature (which is a checkbox in the console) with a standalone service, when in fact the underlying service that performs the encryption and key management is AWS KMS.

How to eliminate wrong answers

Option B is wrong because Amazon S3 server-side encryption is a feature specific to objects stored in Amazon S3 buckets, not applicable to RDS DB instance storage. Option C is wrong because 'RDS encryption feature' is not a standalone service; it is a feature that relies on AWS KMS to manage the encryption keys — the question asks which service or feature should be used, and KMS is the underlying service that enables RDS encryption. Option D is wrong because SSL/TLS certificates are used to encrypt data in transit between the client and the database, not data at rest stored on disk.

Full explanation →

256

MCQmedium

A company has an AWS Lambda function that needs to access an Amazon RDS database. The database is in a private subnet. Which configuration will allow the Lambda function to securely access the database without traversing the internet?

A.Create a VPC peering connection between the Lambda VPC and the RDS VPC.

B.Place the Lambda function in a public subnet and use a NAT gateway to access the RDS database.

C.Configure the Lambda function to run in the same VPC as the RDS database, in the same private subnet.

D.Use a VPC endpoint for Lambda to connect to the RDS database.

AnswerC

Attaching the Lambda function to the VPC and placing it in the same private subnet as the RDS instance allows the function's elastic network interface to communicate directly with the database over private IP addresses. This satisfies the security group rules—Lambda can use its own security group to allow inbound traffic to RDS on the database port. There is no need for internet access or NAT, and the connection remains within the private network. This is the recommended AWS pattern for Lambda plus RDS in the same VPC.

Why this answer

Placing the Lambda function in the same VPC and the same private subnet as the RDS database allows the Lambda function to communicate with the database directly over the AWS network using private IP addresses. This configuration ensures traffic does not traverse the internet, and it leverages VPC routing and security groups for access control. Lambda functions must be configured with VPC settings to access resources in private subnets, and when both are in the same subnet, no additional gateways or peering are required.

Exam trap

The trap here is that candidates often assume Lambda functions always run inside a VPC by default, but in reality, Lambda runs in an AWS-managed VPC unless explicitly configured with VPC settings, and they mistakenly think VPC endpoints can be used for any AWS service, including RDS, when in fact RDS does not support VPC interface endpoints for database connections.

How to eliminate wrong answers

Option A is wrong because VPC peering connects two separate VPCs, but Lambda functions run within a VPC only when explicitly configured; the default Lambda execution environment is outside any VPC, so peering does not apply unless the Lambda is already in a VPC. Option B is wrong because placing the Lambda function in a public subnet and using a NAT gateway would still route traffic through the internet (via the NAT gateway) to reach the RDS database in a private subnet, which is unnecessary and less secure; direct VPC placement avoids internet traversal. Option D is wrong because VPC endpoints are used for connecting to AWS services like S3 or DynamoDB via PrivateLink, not for connecting to an RDS database; RDS does not support VPC interface endpoints for database connections.

Full explanation →

257

MCQmedium

A company uses Amazon GuardDuty in a single AWS account to detect threats. The security team receives an alert that a specific EC2 instance is communicating with a known command and control (C2) server. The security engineer needs to immediately isolate the instance while preserving the root cause evidence. The engineer has access to the AWS Management Console. Which action should the engineer take FIRST?

A.Terminate the instance immediately to stop the communication.

B.Take a snapshot of the EBS volume and then isolate the instance by modifying the security group.

C.Modify the security group to block all outbound traffic.

D.Install the CloudWatch Logs agent on the instance to capture logs.

AnswerB

Snapshot preserves evidence, then isolation stops communication.

Why this answer

The correct first action is to take a snapshot of the EBS volume to preserve root cause evidence, then modify the security group to block all outbound traffic, isolating the instance. Option A is incorrect because terminating the instance destroys volatile evidence and may not capture the current state. Option C is incorrect because modifying the security group without first taking a snapshot could lose critical evidence before isolation.

Option D is incorrect because installing the CloudWatch agent takes time and does not immediately stop communication or isolate the instance.

Full explanation →

258

MCQeasy

A company configures a Route 53 alias record to point to a CloudFront distribution. The security team wants to ensure that users can only access the website via CloudFront and not directly via the S3 bucket origin. What additional configuration is needed?

A.Create an Origin Access Control (OAC) for the S3 bucket origin

B.Create a Route 53 health check to verify CloudFront availability

C.Configure CloudFront signed URLs to restrict access

D.Attach a security group to the S3 bucket

AnswerA

OAC ensures only CloudFront can access the S3 bucket.

Why this answer

An Origin Access Control (OAC) is the recommended AWS mechanism to restrict access to an S3 bucket origin so that it only accepts requests from a specific CloudFront distribution. By configuring OAC on the CloudFront distribution and updating the S3 bucket policy to deny any requests that do not include the required OAC headers, the security team ensures that users cannot bypass CloudFront and access the S3 bucket directly via its public URL.

Exam trap

The trap here is that candidates often confuse CloudFront signed URLs (which control user access to content) with origin access controls (which restrict which origin server CloudFront can talk to), leading them to pick option C instead of A.

How to eliminate wrong answers

Option B is wrong because a Route 53 health check verifies the availability of a resource (e.g., CloudFront) for DNS failover, but it does not enforce access restrictions or prevent direct access to the S3 bucket. Option C is wrong because CloudFront signed URLs control access to individual objects by requiring authentication tokens, but they do not prevent users from accessing the S3 bucket directly if the bucket is publicly accessible; signed URLs are for per-request authorization, not origin access control. Option D is wrong because S3 buckets do not support security groups; security groups are a network firewall construct for EC2 instances and other VPC resources, not for S3.

Access to S3 is controlled via bucket policies, IAM policies, or OAC.

Full explanation →

259

MCQmedium

A security engineer is configuring automated response to a GuardDuty finding of type 'UnauthorizedAccess:EC2/SSHBruteForce'. The engineer needs to isolate the compromised instance by modifying the security group to deny all inbound traffic. Which AWS service should be used to orchestrate this response?

A.AWS Lambda

B.AWS CloudFormation

C.AWS Config

D.AWS Systems Manager Automation

AnswerD

Systems Manager Automation is the correct service because it uses automation documents (runbooks) designed specifically to perform operational remediation in a controlled, repeatable way. A runbook can include steps that modify security group rules, stop or isolate EC2 instances, collect diagnostics, or invoke Lambda functions, and it supports IAM roles, approval gates, and rate controls for safe execution. EventBridge rules can trigger these runbooks automatically from security findings, making it the orchestration layer for automated incident response.

Why this answer

AWS Systems Manager Automation is the correct service because it provides a pre-built runbook, AWS-IsolateInstanceEC2, specifically designed to isolate an EC2 instance by modifying its security group to deny all inbound traffic. This runbook can be triggered directly by a CloudWatch Events rule that matches the GuardDuty finding, enabling fully automated incident response without custom code. Systems Manager Automation also supports cross-account and cross-region execution, making it suitable for enterprise-scale response orchestration.

Exam trap

The trap here is that candidates often choose AWS Lambda because they think they need custom code to modify security groups, but AWS Systems Manager Automation provides a pre-built, auditable, and fully managed runbook that eliminates the need for custom code and is the recommended service for orchestrating automated incident response actions.

How to eliminate wrong answers

Option A is wrong because AWS Lambda is a compute service for running custom code, not an orchestration service; while you could write a Lambda function to modify security groups, the question asks for the service to *orchestrate* the response, and Systems Manager Automation provides a managed, auditable runbook without requiring custom code. Option B is wrong because AWS CloudFormation is an infrastructure-as-code service for provisioning resources, not for real-time incident response orchestration; it cannot dynamically react to a GuardDuty finding and execute a security group modification. Option C is wrong because AWS Config is a configuration auditing and compliance service that evaluates resource configurations against rules, but it cannot execute remediation actions like modifying security groups; it can only trigger Lambda or Systems Manager for remediation, not perform the action itself.

Full explanation →

260

MCQhard

A company has a critical application that stores sensitive data in Amazon DynamoDB. The security team requires that all data stored in DynamoDB is encrypted at rest using a customer-managed KMS key. Additionally, they want to ensure that the key can be rotated automatically every year. Which combination of actions should be taken?

A.Use a CloudHSM key store and enable automatic rotation

B.Use a customer-managed KMS key and enable automatic key rotation

C.Use an AWS managed KMS key and enable automatic key rotation

D.Enable encryption on the existing DynamoDB table and use a customer-managed KMS key

AnswerB

Correct: DynamoDB supports customer-managed KMS keys and KMS automatic rotation.

Why this answer

DynamoDB supports encryption at rest with a customer-managed KMS key, and KMS supports automatic annual rotation for customer-managed keys. Option A is wrong because DynamoDB does not use CloudHSM. Option C is wrong because automatic rotation is not available for AWS managed keys (which DynamoDB uses by default).

Option D is wrong because you cannot enable encryption on a table created without encryption except by recreating it.

Full explanation →

261

Multi-Selectmedium

A security engineer is implementing centralized logging across multiple AWS accounts. Which TWO actions should the engineer take to ensure logs are securely stored and immutable? (Choose TWO.)

Select 2 answers

A.Enable S3 Transfer Acceleration on the bucket

B.Use AWS KMS with a customer managed key for encryption

C.Enable S3 Object Lock on the destination bucket

D.Enable CloudTrail log file validation

E.Enable MFA Delete on the bucket

AnswersB, C

KMS provides encryption and access control.

Why this answer

Using AWS KMS with a customer managed key (CMK) for encryption ensures that the security engineer has full control over the encryption keys, including key rotation, access policies, and the ability to disable or revoke the key. This prevents unauthorized decryption of logs, even by AWS, and is a critical component of securing log data at rest. Option C is correct because enabling S3 Object Lock on the destination bucket enforces a write-once-read-many (WORM) model, preventing logs from being deleted or overwritten for a specified retention period, which ensures immutability and compliance with regulatory requirements.

Exam trap

The trap here is that candidates often confuse CloudTrail log file validation (which only detects tampering) with immutability (which prevents tampering), or they mistakenly think MFA Delete provides the same WORM protection as S3 Object Lock.

Full explanation →

262

MCQmedium

A security engineer is designing a VPC with a public subnet and a private subnet. The private subnet will host a database instance that should only be accessible from the application instances in the public subnet. The application instances use an Auto Scaling group. Which configuration ensures that only the application instances can access the database?

A.Allow inbound database port from the security group attached to the application instances in the public subnet.

B.Allow inbound database port from 0.0.0.0/0 in the database security group.

C.Configure a network ACL on the private subnet to allow the database port from the public subnet CIDR.

D.Allow inbound database port from the public subnet CIDR block in the database security group.

AnswerA

This dynamically allows traffic from all application instances.

Why this answer

Security group rules can reference other security groups, allowing dynamic scaling of the application instances without needing to update CIDR blocks. Auto Scaling group instances are automatically assigned the application security group, so only they can access the database. Option B is incorrect because allowing 0.0.0.0/0 would expose the database to the internet.

Option C is incorrect because network ACLs are stateless and cannot reference security groups; they would require explicit rules for return traffic. Option D is incorrect because referencing the public subnet CIDR would allow any instance in that subnet, not just the application instances, and would not handle changes in the application instances' IPs.

Full explanation →

263

MCQeasy

A company needs to encrypt data at rest in Amazon EBS volumes. They want to use an AWS managed key that is automatically rotated. Which encryption option should they choose?

A.Use SSE-S3.

B.Enable EBS encryption by default using the AWS managed key for Amazon EBS.

C.Use a customer-managed KMS key with automatic rotation enabled.

D.Use client-side encryption.

AnswerB

Enable EBS encryption by default establishes that every newly created EBS volume and snapshot is encrypted with the volume's key—the AWS managed key with alias aws/ebs—without requiring per-volume configuration. Because this is an AWS managed key, AWS rotates it automatically and handles the key material, so the company does not need to manage lifecycle or permissions. This satisfies the requirement to encrypt data at rest in the EBS volume directly at the block-storage layer.

Why this answer

Enabling EBS encryption by default using the AWS managed key for Amazon EBS (alias `aws/ebs`) ensures data at rest is encrypted with a key that is automatically rotated on an annual basis, as required. This key is managed by AWS and requires no manual intervention for rotation, meeting the company's need for a managed, automatically rotated key.

Exam trap

The trap here is that candidates often confuse 'AWS managed key' with 'customer-managed KMS key with automatic rotation enabled,' but the key distinction is that a customer-managed key is not an AWS managed key—it is managed by the customer, even if rotation is automated.

How to eliminate wrong answers

Option A is wrong because SSE-S3 is an encryption option for Amazon S3, not for Amazon EBS volumes; it uses S3-managed keys and is irrelevant to EBS encryption. Option C is wrong because while a customer-managed KMS key can have automatic rotation enabled, it is not an AWS managed key—it is customer-managed, meaning the customer retains control and responsibility, which does not satisfy the requirement for an AWS managed key. Option D is wrong because client-side encryption occurs before data reaches AWS and does not use an AWS managed key; it requires the customer to manage encryption keys locally, contradicting the need for an AWS managed, automatically rotated key.

Full explanation →

264

MCQmedium

A security team needs to analyze historical CloudTrail logs across multiple AWS accounts to detect patterns of suspicious activity. Which solution provides the MOST cost-effective and scalable analysis?

A.Aggregate logs into a central S3 bucket and query with Amazon Athena

B.Stream logs to Amazon Elasticsearch Service and use Kibana

C.Load logs into Amazon Redshift for analysis

D.Use Amazon CloudWatch Logs Insights across all accounts

AnswerA

Centralizing CloudTrail logs in a single S3 bucket is the AWS-recommended architecture for historical analysis. Amazon Athena uses serverless Presto/Trino to run SQL directly over S3 objects, charging only for bytes scanned, which is cost-effective for infrequent deep queries. Partitioning the data by date and converting to columnar formats like Parquet further reduces scan costs and speeds up analysis. This approach avoids provisioning any compute, making it the natural fit for auditing historical events across accounts.

Why this answer

Aggregating CloudTrail logs into a central S3 bucket and querying with Amazon Athena is the most cost-effective and scalable solution because Athena uses a serverless, pay-per-query model with no infrastructure to manage, and it can directly analyze large volumes of structured log data stored in S3 using standard SQL. This approach avoids the cost of provisioning and maintaining dedicated clusters (as with Redshift or Elasticsearch) and avoids the per-GB ingestion and storage fees of CloudWatch Logs Insights, making it ideal for historical analysis across multiple accounts.

Exam trap

The trap here is that candidates often choose CloudWatch Logs Insights (Option D) because it seems convenient for log analysis, but they overlook its high ingestion costs and limited retention for historical data, whereas Athena's serverless, pay-per-query model is far more cost-effective for large-scale, infrequent queries of archived logs.

How to eliminate wrong answers

Option B is wrong because streaming logs to Amazon Elasticsearch Service (now OpenSearch Service) incurs ongoing costs for cluster instances, storage, and data ingestion, and it is not as cost-effective for infrequent historical queries compared to Athena's pay-per-query model. Option C is wrong because loading logs into Amazon Redshift requires provisioning a cluster, paying for compute and storage even when idle, and involves ETL overhead, making it overkill and more expensive for ad-hoc analysis of CloudTrail logs. Option D is wrong because Amazon CloudWatch Logs Insights is designed for real-time log analysis and has a per-GB ingestion cost and a limited query history retention (typically 30 days), making it unsuitable and costly for analyzing long-term historical logs across multiple accounts.

Full explanation →

265

Multi-Selectmedium

A company wants to restrict access to an S3 bucket so that only objects with specific tags can be accessed by a certain IAM role. Which THREE steps are required to implement this?

Select 3 answers

A.Use S3 Inventory to list objects and their tags.

B.Enable S3 object-level logging in CloudTrail.

C.Attach an IAM policy to the role that uses the s3:ExistingObjectTag condition.

D.Create a bucket policy with a condition based on the s3:ExistingObjectTag key.

E.Set a bucket policy that denies access if the object does not have the required tag.

AnswersC, D, E

IAM policies can also use condition keys to restrict access based on tags.

Why this answer

To restrict the IAM role to only access objects with specific tags, three steps are necessary. First, attach an IAM policy to the role using the s3:ExistingObjectTag condition key (option C). This alone, however, can be overridden by a bucket policy that grants broader access.

Second, create a bucket policy that explicitly allows the role to access objects only when they have the required tag (option D). Third, create a bucket policy that denies the role access to objects that do not have the required tag (option E). The combination of IAM and bucket policies ensures tag-based access control is enforced, as IAM provides identity-based restrictions and bucket policies add resource-based checks, including an explicit deny for non-compliant objects.

Exam trap

The trap here is that candidates often confuse S3 Inventory (a reporting tool) or CloudTrail logging (an auditing tool) with access control mechanisms, leading them to select options that do not actually restrict access.

Full explanation →

266

MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all IAM users in the production account must use multi-factor authentication (MFA) to access the AWS Management Console. Which combination of actions should the security team take to enforce this requirement?

A.Use an SCP to deny access to the AWS Management Console unless MFA is present. Attach the SCP to the production OU.

B.Disable password-based access for all IAM users and require federation with an identity provider that enforces MFA.

C.Enable MFA on the root user and apply a password policy that requires MFA.

D.Create an IAM policy that denies all console actions unless MFA is present. Attach the policy to the IAM group that contains all production users.

AnswerD

After an IAM user signs in to the console with only a password, the resulting temporary credentials have aws:MultiFactorAuthPresent set to false. An explicit deny policy using that condition key will block every console action, forcing the user to either re-authenticate with MFA or call STS GetSessionToken with MFA to obtain valid credentials. This effectively enforces MFA for all console access and directly satisfies the stated requirement for production users.

Why this answer

An IAM policy with a condition that denies all console actions unless MFA is present can be attached to an IAM group containing all production users. This enforces MFA at the user level within the account, directly meeting the requirement to ensure all IAM users in the production account must use MFA to access the AWS Management Console.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking SCPs can enforce MFA for console access within an account, but SCPs apply at the organizational level and cannot target specific IAM users or groups within an account.

How to eliminate wrong answers

Option A is wrong because SCPs cannot deny access to the AWS Management Console specifically; they deny actions on AWS resources, and the condition for MFA in an SCP would apply to all accounts in the OU, not just the production account's IAM users. Option B is wrong because disabling password-based access and requiring federation with an identity provider that enforces MFA is a valid approach but not listed as a combination of actions that the security team can take directly within the production account; it requires external setup and does not enforce MFA for existing IAM users. Option C is wrong because enabling MFA on the root user and applying a password policy that requires MFA does not enforce MFA for all IAM users; the root user MFA is separate, and password policies cannot enforce MFA for console access.

Full explanation →

267

Multi-Selectmedium

A security engineer is designing a data protection strategy for an S3 bucket that contains sensitive documents. The bucket is accessed by multiple IAM users and roles. Which TWO actions will help protect the data at rest and in transit?

Select 2 answers

A.Enable S3 Access Logs and send them to a separate account

B.Add a bucket policy that denies requests without aws:SecureTransport

C.Enable MFA Delete on the S3 bucket

D.Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS

E.Use pre-signed URLs for all access

AnswersB, D

This enforces HTTPS for data in transit.

Why this answer

Enforcing HTTPS (aws:SecureTransport) protects data in transit by requiring all requests to use TLS. Option D is correct because enabling default encryption (SSE-S3 or SSE-KMS) ensures data at rest is automatically encrypted when written to S3. Option A is incorrect: S3 Access Logs are for auditing access, not for protecting data.

Option C is incorrect: MFA Delete protects against accidental deletion, not data protection at rest or in transit. Option E is incorrect: pre-signed URLs provide time-limited access but do not inherently protect data at rest or enforce encryption in transit.

Exam trap

Candidates often confuse auditing (Access Logs) or deletion protection (MFA Delete) with data protection mechanisms. The question specifically asks for protecting data at rest and in transit, which are encryption and transport enforcement.

Full explanation →

268

Multi-Selecteasy

A security engineer needs to ensure that all changes to IAM policies in an AWS account are logged and that the logs are immutable and cannot be deleted by any user, including the root user. Which actions should the engineer take? (Choose two.)

Select 2 answers

A.Enable default encryption with AWS KMS on the bucket.

B.Enable AWS CloudTrail to log IAM events.

C.Enable S3 Versioning on the bucket.

D.Enable multi-factor authentication (MFA) delete on the S3 bucket.

E.Enable S3 Object Lock in compliance mode on the bucket.

AnswersB, E

CloudTrail records all IAM API calls.

Why this answer

AWS CloudTrail is the service specifically designed to log all API activity, including IAM policy changes. By enabling CloudTrail with management event logging, all IAM CreatePolicy, PutPolicy, DeletePolicy, and similar actions are recorded in a log file delivered to an S3 bucket. This provides an authoritative audit trail of who made the change, when, and from which source IP.

Option E is correct because S3 Object Lock in compliance mode prevents any user, including the root user, from overwriting or deleting objects for the specified retention period. This ensures the log files are immutable and cannot be tampered with or deleted, fulfilling the requirement that logs cannot be deleted by any user.

Exam trap

The trap here is that candidates often confuse S3 Versioning (which provides object recovery but not immutability) with S3 Object Lock (which provides true WORM immutability), and they may also overlook that MFA Delete still allows deletion by an authorized user with MFA, not preventing root from ultimately deleting logs.

Full explanation →

269

MCQeasy

A company is using AWS WAF to protect a web application. The security team wants to receive alerts when a specific rule block is triggered. Which AWS service should they use to achieve this?

A.Amazon EventBridge

B.CloudWatch Alarms with SNS

C.Amazon S3

D.Amazon SNS

AnswerB

AWS WAF publishes real-time CloudWatch metrics such as BlockedCount and CountedCount for each web ACL and rule. A CloudWatch Alarm can monitor these metrics and transition to the ALARM state when a threshold (e.g., blocked requests exceed 100 per minute) is breached, then automatically publish to an SNS topic to send email or SMS notifications. This is the native, direct alerting mechanism for WAF rule events because it uses the service's own metric stream.

Why this answer

AWS WAF integrates with Amazon CloudWatch to provide metrics for each rule, including the 'BlockedRequests' count. By creating a CloudWatch Alarm on this metric, you can trigger an SNS notification when the threshold is exceeded, alerting the security team. This is the standard pattern for receiving alerts on WAF rule actions, as CloudWatch Alarms with SNS provide the necessary monitoring and notification pipeline.

Exam trap

The trap here is that candidates often confuse the notification mechanism (SNS) with the evaluation mechanism (CloudWatch Alarms), selecting SNS alone without recognizing that CloudWatch Alarms are required to evaluate the WAF metric and trigger the notification.

How to eliminate wrong answers

Option A is wrong because Amazon EventBridge is used for event-driven architectures to route events from various sources to targets, but it does not natively evaluate metric thresholds or generate alerts based on WAF rule triggers without additional custom logic. Option C is wrong because Amazon S3 is an object storage service and cannot evaluate metrics or send alerts; it can only store logs or data. Option D is wrong because Amazon SNS alone is a notification service that requires a publisher to send messages; without a CloudWatch Alarm to evaluate the WAF metric and publish to the SNS topic, no alert will be generated.

Full explanation →

270

MCQhard

Refer to the exhibit. A security engineer runs the IAM Policy Simulator with the provided policy input. The result shows 'explicitDeny' for ec2:RunInstances even though the policy only contains an Allow. What is the most likely reason?

A.The user has an attached policy or SCP that explicitly denies ec2:RunInstances.

B.The policy input has a syntax error.

C.The simulate-custom-policy command does not support ec2:RunInstances.

D.The resource ARN is incorrect for ec2:RunInstances.

AnswerA

Explicit deny overrides Allow; other policies may be causing the deny.

Why this answer

The most likely reason is that the user has another policy attached (such as an identity-based policy or a service control policy) that explicitly denies ec2:RunInstances. The IAM Policy Simulator evaluates all applicable policies, so even if the provided policy only contains an Allow, an explicit deny from another policy overrides and results in an explicitDeny. Option B (syntax error) is not likely because a syntax error typically causes an error or implicit deny, not an explicit deny.

Option C is incorrect because the simulate-custom-policy command does support ec2:RunInstances. Option D is incorrect because an incorrect resource ARN would result in an implicit deny, not an explicit deny.

Full explanation →

271

MCQmedium

Refer to the exhibit. An AWS Config rule 's3-bucket-ssl-requests-only' evaluates whether S3 buckets deny HTTP requests. The exhibit shows the evaluation result and the bucket policy. Why is the bucket marked as NON_COMPLIANT despite having a Deny policy for HTTP requests?

A.The bucket policy is missing the 'aws:SecureTransport': 'false' condition for the bucket resource (without /*).

B.The policy uses 'Deny' but the rule expects an 'Allow' statement for HTTPS only.

C.The bucket policy only denies HTTP requests to objects, not to the bucket itself.

D.The annotation says 'Bucket does not have a policy that denies HTTP requests.' but the policy does have one, so this is a false positive.

AnswerA

The rule may check that the bucket itself (not just objects) denies HTTP requests. The policy only covers objects. Adding a statement for the bucket ARN 'arn:aws:s3:::my-bucket' would fix the compliance.

Why this answer

The Config rule likely evaluates the bucket-level policy. The current policy only denies HTTP requests to objects (/*), not to the bucket itself. To be compliant, the bucket must also have a Deny for the bucket resource ARN without the /*.

Full explanation →

272

MCQhard

A security team wants to centrally collect and analyze VPC Flow Logs from multiple AWS accounts for security monitoring. Which solution is MOST scalable and cost-effective?

A.Aggregate logs in an EC2 instance running an ELK stack.

B.Use Amazon Kinesis Data Firehose to stream logs to an S3 bucket and process with AWS Lambda.

C.Configure VPC Flow Logs to send to a centralized CloudWatch Logs account using cross-account subscriptions.

D.Use AWS Organizations to centralize logging by delivering VPC Flow Logs to a centralized S3 bucket and query with Amazon Athena.

AnswerD

This approach is scalable, cost-effective, and uses managed services.

Why this answer

Using AWS Organizations to centrally deliver VPC Flow Logs to a centralized S3 bucket, then querying with Amazon Athena, is both scalable and cost-effective. S3 provides durable, low-cost storage for large volumes of log data, and Athena allows serverless, pay-per-query analysis without provisioning infrastructure. This approach avoids the operational overhead of managing EC2 instances or streaming pipelines, and scales seamlessly as log volume grows.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing a streaming or real-time processing service (like Kinesis or CloudWatch Logs) when the requirement is for cost-effective batch analysis, not real-time alerting.

How to eliminate wrong answers

Option A is wrong because running an ELK stack on an EC2 instance introduces significant operational overhead, requires manual scaling, and incurs costs for compute and storage even when idle, making it less scalable and cost-effective than serverless alternatives. Option B is wrong because Amazon Kinesis Data Firehose to S3 with Lambda processing adds unnecessary complexity and cost for a use case that can be served by direct S3 delivery and Athena queries, and Firehose is optimized for streaming ingestion, not batch log analysis. Option C is wrong because cross-account CloudWatch Logs subscriptions require managing subscription filters and IAM roles across accounts, and CloudWatch Logs costs are higher per GB ingested and stored compared to S3, making it less cost-effective for high-volume VPC Flow Logs.

Full explanation →

273

MCQhard

Refer to the exhibit. An IAM user has this policy attached. The user tries to download an object from the S3 bucket using the AWS CLI from an on-premises server with IP address 198.51.100.50. What will happen?

A.The request will succeed because the policy allows s3:GetObject.

B.The request will fail because the user must use HTTPS.

C.The request will fail because the user's IP is not in the allowed range.

D.The request will fail because the user must use MFA.

AnswerC

The condition restricts to 192.0.2.0/24.

Why this answer

The policy includes a condition that restricts access to only requests originating from a specific IP address range. Since the user's on-premises server IP (198.51.100.50) is not within that allowed range, the request will be denied. Option A is incorrect because the policy does not grant unconditional access; the condition overrides the Allow effect.

Option B is incorrect because the policy does not require HTTPS; it only checks the source IP. Option D is incorrect because there is no MFA condition in the policy.

Full explanation →

274

MCQeasy

A security engineer needs to capture all API calls made to AWS services for forensic analysis. Which AWS service should be used to store these logs durably and cost-effectively for long-term retention?

A.VPC Flow Logs

B.Amazon GuardDuty

C.AWS Config

D.AWS CloudTrail

AnswerD

AWS CloudTrail logs all API calls and can deliver logs to S3.

Why this answer

AWS CloudTrail is the correct service because it captures all API calls made to AWS services, including the identity of the caller, time of the call, source IP address, and request parameters. It stores these logs durably in Amazon S3, which provides cost-effective long-term retention for forensic analysis. CloudTrail is specifically designed for auditing and monitoring API activity across an AWS environment.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks resource configuration changes) with CloudTrail (which tracks API calls), leading them to select Config when the question explicitly asks for capturing API calls.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) at the VPC level, not API calls to AWS services. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes logs (including CloudTrail, VPC Flow Logs, and DNS logs) for malicious activity, but it does not natively store or capture raw API call logs for long-term retention. Option C is wrong because AWS Config records resource configuration changes and evaluates compliance rules, but it does not capture API calls; it focuses on resource state history, not the API actions that caused changes.

Full explanation →

275

MCQmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket in the management account. What is the most efficient way to enforce this across all accounts?

A.Create a service control policy (SCP) that denies modifications to CloudTrail settings.

B.Use AWS Trusted Advisor to check CloudTrail status and send alerts.

C.Configure each account individually with a CloudTrail trail pointing to the central bucket.

D.Use AWS Config rules in each account to detect non-compliant trails.

AnswerA

SCPs can prevent disabling CloudTrail or altering trail configurations across all accounts.

Why this answer

The most efficient way to enforce CloudTrail across all accounts in an AWS Organization is to use a Service Control Policy (SCP) that denies the ability to stop or modify CloudTrail settings. SCPs are applied at the organization level and affect all member accounts, preventing any user or role from disabling CloudTrail or changing trail configuration, regardless of their IAM permissions. This ensures compliance without needing per-account setup.

Option B (Trusted Advisor) only provides alerts, not enforcement. Option C requires manual configuration per account, which is inefficient and error-prone. Option D (AWS Config rules) can detect non-compliance but cannot prevent changes from being made.

Full explanation →

276

MCQmedium

A security engineer notices that an S3 bucket contains objects that are accessible to authenticated users from other AWS accounts. The bucket policy allows access to the 'aws:SourceArn' condition that references an Amazon Resource Name (ARN) from another account. What is the MOST effective way to restrict access to only users from the company's own account?

A.Apply an SCP to deny s3:GetObject for any principal outside the organization.

B.Remove the bucket policy and add an IAM policy to the company's users.

C.Modify the condition to use 'aws:SourceArn' with an ARN from the company's account.

D.Add a condition using 'aws:SourceAccount' with the company's account ID.

AnswerD

Restricts access to requests originating from the specified account.

Why this answer

Using the 'aws:SourceAccount' condition key with the company's account ID ensures that only requests originating from that account are allowed, effectively blocking cross-account access from other accounts. Option A is incorrect because SCPs apply to principals within the organization and cannot restrict access from external accounts ('aws:SourceAccount' is not evaluated for SCPs). Option B is incorrect because simply removing the bucket policy would break all cross-account access but also removes any existing policy-based permissions within the account; adding IAM policies alone does not grant cross-account access and may not be the most effective solution.

Option C is incorrect because 'aws:SourceArn' is typically used for service-to-service access (e.g., SNS to S3) and does not reliably restrict by account; the proper condition key for account-level restriction is 'aws:SourceAccount'.

Full explanation →

277

MCQhard

A company has enabled AWS CloudTrail in all accounts and regions, with log file validation enabled. The security team needs to verify that a specific log file has not been modified since it was delivered. Which action should be taken?

A.Query the log files using Amazon CloudWatch Logs Insights.

B.Enable S3 server-side encryption with AWS KMS (SSE-KMS) on the CloudTrail bucket.

C.Enable S3 Object Lock on the bucket to prevent modifications.

D.Use the AWS CLI `validate-logs` command with the digest file from the S3 bucket.

AnswerD

The `aws cloudtrail validate-logs` command implements CloudTrail's integrity validation by reading the digest files delivered to the S3 bucket. Each digest file contains the SHA-256 hash of the log files and a digital signature generated with AWS's private key; the CLI retrieves the corresponding public key from AWS, verifies the signature, and then recomputes the hash of each log file to compare against the digest. This process cryptographically confirms that log files were not altered or removed during delivery, providing a tamper-evident chain from the moment CloudTrail wrote the file.

Why this answer

CloudTrail log file validation creates a hash of each log file and stores it in a digest file. To verify that a specific log file has not been altered since delivery, you must use the AWS CLI `validate-logs` command, which compares the hash in the digest file against the current hash of the log file. This command also validates the digital signature of the digest file itself, ensuring end-to-end integrity.

Exam trap

The trap here is that candidates confuse data integrity verification (hash comparison) with data protection mechanisms like encryption or object lock, which prevent or obscure modification but do not prove that a file has remained unchanged since its creation.

How to eliminate wrong answers

Option A is wrong because CloudWatch Logs Insights is used for querying and analyzing log data, not for cryptographic integrity verification of individual log files. Option B is wrong because SSE-KMS encrypts data at rest but does not provide any mechanism to detect or prevent modification of log files after delivery. Option C is wrong because S3 Object Lock prevents deletion or overwrite of objects during a retention period, but it does not verify the integrity of already-delivered log files or detect modifications made before the lock was applied.

Full explanation →

278

MCQmedium

A company has deployed a multi-tier web application on AWS. The web servers are in a public subnet, and the application servers are in a private subnet. The security team wants to ensure that the application servers cannot initiate outbound connections to the internet. What should the team do?

A.Add a deny rule for all outbound traffic in the network ACL of the private subnet.

B.Modify the security group of the application servers to deny all outbound traffic.

C.Remove the default route (0.0.0.0/0) pointing to an internet gateway or NAT gateway from the private subnet's route table.

D.Attach an egress-only internet gateway to the private subnet.

AnswerC

Removing the default route (0.0.0.0/0) to an internet gateway or NAT gateway from the private subnet's route table eliminates the only path for outbound traffic to reach the internet. Route tables govern where traffic is sent from the subnet; without a default route, any packet destined outside the VPC has no route and is dropped. This does not affect inbound traffic, which is controlled by security groups and network ACLs, making it a precise and effective solution.

Why this answer

Removing the default route (0.0.0.0/0) from the private subnet's route table ensures that any traffic destined for the internet has no valid path, effectively preventing application servers from initiating outbound internet connections. Network ACLs and security groups are stateful or stateless filters but do not control routing; without a route, packets cannot leave the subnet regardless of allow rules. This aligns with the principle of using route tables to enforce network segmentation in a multi-tier architecture.

Exam trap

The trap here is that candidates often confuse security group rules or network ACLs with routing decisions, mistakenly believing that blocking outbound traffic at the firewall level is sufficient, when in fact AWS routes traffic before applying security group or ACL rules, so without a route, no traffic can leave the subnet regardless of allow rules.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and apply to both inbound and outbound traffic at the subnet level, but adding a deny rule for all outbound traffic would still allow return traffic for established connections if inbound rules permit it; more importantly, it does not prevent the application servers from initiating connections if a route exists, as the ACL only filters packets that are already routed. Option B is wrong because security groups are stateful and cannot deny outbound traffic; they only support allow rules, and by default all outbound traffic is allowed unless explicitly removed, but removing all outbound rules still permits return traffic for inbound-initiated connections due to statefulness, and the security group does not control routing. Option D is wrong because an egress-only internet gateway is designed for IPv6 traffic to allow outbound-only connections from a private subnet, which would actually enable outbound internet access for IPv6, contrary to the requirement to prevent all outbound internet connections.

Full explanation →

279

MCQeasy

A security engineer is investigating a potential compromise of an EC2 instance. The engineer wants to capture memory and disk forensics without shutting down the instance. Which service should the engineer use?

A.AWS Config

B.AWS Systems Manager

C.EC2 Instance Connect

D.Amazon CloudWatch Logs

AnswerB

AWS Systems Manager, especially via Run Command and Session Manager, gives you a controlled, auditable channel to execute arbitrary scripts on EC2 instances without opening SSH or RDP. You can run built-in SSM documents or custom scripts to capture memory dumps, collect disk evidence, and pull system logs for an investigation. Its agent is already installed on many instances, making it the standard tool for on-host forensic collection.

Why this answer

AWS Systems Manager (SSM) is the correct service because it provides the capability to perform forensic data collection on a running EC2 instance without shutting it down. Specifically, SSM Automation documents like AWS-RunShellScript or AWS-GatherEC2InstanceInfo can execute commands to capture memory (e.g., using LiME or fmem) and disk forensics (e.g., dd or volume snapshots) via the SSM Agent, which runs as a system service and does not require instance termination.

Exam trap

The trap here is that candidates may confuse AWS Systems Manager with EC2 Instance Connect, thinking that SSH access alone is sufficient for forensic collection, but Systems Manager provides the necessary automation and agent-based execution to capture memory and disk data without requiring the instance to be stopped or terminated.

How to eliminate wrong answers

Option A is wrong because AWS Config is a service for resource inventory, compliance auditing, and configuration change tracking, not for capturing memory or disk forensics on a running instance. Option C is wrong because EC2 Instance Connect only provides SSH access to the instance for interactive shell sessions; it does not have built-in capabilities to capture memory dumps or perform disk forensics without additional tools and manual intervention. Option D is wrong because Amazon CloudWatch Logs is a service for collecting, monitoring, and storing log files from EC2 instances and other sources; it cannot capture memory or disk forensics data directly.

Full explanation →

280

MCQmedium

A security engineer notices that an IAM user has permissions to launch EC2 instances but the engineer wants to ensure that all new instances are automatically tagged with the creator's user name. What is the most efficient way to enforce this?

A.Use AWS CloudTrail to monitor and alert on untagged instances.

B.Add an IAM policy to the user that uses a condition key 'aws:RequestTag/Creator' with a value '${aws:username}'.

C.Use AWS Config rules to automatically tag resources after creation.

D.Create an SCP that denies EC2:RunInstances unless the request includes a 'Creator' tag with the user name.

AnswerB

This condition forces the user to include the tag with their username.

Why this answer

Using an IAM policy with a condition key 'aws:RequestTag/Creator' set to '${aws:username}' ensures that any EC2 RunInstances request must include the tag 'Creator' with the IAM user's name, otherwise the request is denied. This enforces tagging at the time of instance creation. Option A (CloudTrail) only provides auditing, not enforcement.

Option C (AWS Config rules) can detect and remediate after creation but is less efficient than proactive enforcement. Option D (SCP) can deny based on missing tags but cannot enforce the tag value to match the user name; also, SCPs are used for account-wide policies, not per-user.

Full explanation →

281

MCQhard

A company is designing a VPC with public and private subnets. The application servers in the private subnets need to download patches from the internet. Which architecture provides the highest security while allowing internet access?

A.Place a NAT Gateway in the public subnet and configure the private subnet route table to send 0.0.0.0/0 traffic to the NAT Gateway

B.Create a VPC endpoint for Amazon S3 and route traffic through it

C.Attach an internet gateway to the private subnet and configure the route table to send 0.0.0.0/0 traffic to the internet gateway

D.Place a bastion host in the public subnet and configure the private instances to route internet traffic through it

AnswerA

The NAT Gateway is deployed in a public subnet with an Elastic IP and performs source network address translation for instances in private subnets. Outbound packets are sent to the NAT Gateway via the 0.0.0.0/0 route, and return traffic is delivered back through the same stateful translation. Because private instances lack public IPs and the route table points to the NAT Gateway rather than an internet gateway, unsolicited inbound connections cannot reach them, making this the standard design for outbound-only internet access.

Why this answer

A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for patch downloads) while preventing any unsolicited inbound traffic from the internet. The private subnet route table sends 0.0.0.0/0 traffic to the NAT Gateway, which then forwards it through the Internet Gateway (IGW) attached to the VPC. This provides the highest security because the private instances remain unreachable from the internet, unlike using an IGW directly or a bastion host for routing.

Exam trap

The trap here is that candidates often confuse a bastion host (for administrative access) with a NAT device (for outbound internet routing), or incorrectly assume that a VPC endpoint can provide general internet access instead of just private connectivity to specific AWS services.

How to eliminate wrong answers

Option B is wrong because a VPC endpoint for Amazon S3 only provides private connectivity to S3, not general internet access for downloading patches from arbitrary internet sources. Option C is wrong because attaching an Internet Gateway directly to a private subnet and routing 0.0.0.0/0 traffic to it would make the subnet effectively public, exposing instances to unsolicited inbound traffic and defeating the purpose of a private subnet. Option D is wrong because a bastion host is designed for secure administrative access (SSH/RDP) to private instances, not for routing general internet traffic; using it as a NAT would create a single point of failure, performance bottleneck, and security risk due to its management plane exposure.

Full explanation →

282

MCQhard

A company uses an AWS Transit Gateway to connect multiple VPCs and on-premises networks. A security engineer needs to ensure that traffic between VPCs is inspected by a third-party firewall appliance. Which architecture should be used?

A.Configure security groups on the transit gateway to inspect traffic.

B.Create VPC endpoints for each VPC to route traffic through the firewall.

C.Attach the firewall appliance to a dedicated inspection VPC and route traffic from other VPCs through the inspection VPC using transit gateway route tables.

D.Use network ACLs on the transit gateway to filter traffic.

AnswerC

This is the standard centralized inspection architecture: deploy the firewall appliance in a dedicated inspection VPC and attach that VPC to the transit gateway, then use separate transit gateway route tables to force all traffic from spoke VPCs to route to the inspection VPC before it proceeds to other attachments. The inspection VPC must also have route tables that forward traffic back to the transit gateway toward the final destination, enabling asymmetric return-path handling and stateful inspection. This design works because the transit gateway routes based on its route tables, so the firewall becomes an inline bump-in-the-wire for all inter-VPC traffic while maintaining a single control point.

Why this answer

It uses a dedicated inspection VPC as a central point for traffic inspection. By attaching the third-party firewall appliance to this inspection VPC and manipulating transit gateway route tables, you can force all inter-VPC traffic to be routed through the firewall for inspection. This architecture leverages the transit gateway's ability to route traffic between attachments based on route table entries, enabling centralized security enforcement without modifying individual VPC routing.

Exam trap

The trap here is that candidates often confuse transit gateway capabilities with VPC-level constructs like security groups or network ACLs, assuming they can be applied directly to the transit gateway, when in fact transit gateway traffic inspection requires a separate inspection VPC architecture.

How to eliminate wrong answers

Option A is wrong because security groups are stateful firewalls applied at the instance or elastic network interface level, not on transit gateways; transit gateways do not support security groups. Option B is wrong because VPC endpoints (Gateway Endpoints or Interface Endpoints) are used for private connectivity to AWS services (e.g., S3, DynamoDB) and cannot route general inter-VPC traffic through a third-party firewall. Option D is wrong because network ACLs are stateless firewalls applied at the subnet level, not on transit gateways; transit gateways do not support network ACLs.

Full explanation →

283

Multi-Selectmedium

A company wants to implement a defense-in-depth strategy for its web application running on EC2 instances. Which TWO AWS services should be used to provide both network and application-layer protection?

Select 2 answers

A.Amazon GuardDuty

B.AWS WAF

C.Security Groups

D.AWS Shield Advanced

E.Network ACLs

AnswersB, C

WAF provides application-layer protection.

Why this answer

AWS WAF is correct because it provides application-layer protection by inspecting HTTP/HTTPS requests to your web application, allowing you to block common attack patterns such as SQL injection and cross-site scripting (XSS) using customizable rules. Security Groups are correct because they act as a virtual firewall at the instance level (network layer), controlling inbound and outbound traffic based on IP addresses, ports, and protocols, thus forming the first line of defense in a defense-in-depth strategy.

Exam trap

The trap here is that candidates often confuse AWS Shield Advanced (which provides DDoS protection) with application-layer filtering, or assume Network ACLs can inspect application data, when in fact they operate only at the network layer and are stateless.

Full explanation →

284

MCQmedium

A company has an S3 bucket that stores sensitive data. The bucket policy allows access only from a specific VPC endpoint. The security engineer tests the configuration and finds that requests from the VPC endpoint are being denied. The bucket policy contains the following condition: "Condition": { "StringEquals": { "aws:SourceVpce": "vpce-12345678" } }. The VPC endpoint ID is correct. The engineer also confirms that the VPC endpoint policy allows the necessary S3 actions. What is the most likely reason for the denial?

A.The request is not being routed through the VPC endpoint; the EC2 instance is using a public S3 endpoint.

B.The EC2 instance does not have an IAM role that allows s3:GetObject.

C.The VPC endpoint is in a different region than the S3 bucket.

D.The condition key is misspelled; it should be aws:SourceVpce (no 'e' at the end).

AnswerA

If not using endpoint, the condition key is not present.

Why this answer

The bucket policy condition aws:SourceVpce only appears in requests that are routed through the specified VPC endpoint. If the EC2 instance accesses S3 via the public internet (using the public S3 endpoint), the request does not include the condition key, and the condition fails, causing denial. Option A correctly identifies this misrouting.

Options B, C, and D are not the primary cause: IAM roles are not the issue here because the bucket policy is denying based on the condition; cross-region access is allowed via endpoints; and the condition key is correctly spelled.

Full explanation →

285

Matchingmedium

Match each AWS VPC flow log type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Capture IP traffic for a VPC

Capture IP traffic for a subnet

Capture IP traffic for a network interface

Capture IP traffic for a transit gateway

Why these pairings

AWS VPC flow logs can be created at three levels: VPC (captures traffic for all interfaces in the VPC), subnet (captures traffic for interfaces in a specific subnet), and ENI (captures traffic for a single elastic network interface). Common confusions include mistaking the scope of each log type.

Full explanation →

286

Multi-Selecthard

A company wants to restrict access to an RDS database to only EC2 instances that have a specific tag 'Environment: Production'. Which TWO steps should be taken?

Select 2 answers

A.Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from the VPC Endpoint.

B.Create a resource-based policy on the RDS instance.

C.Use the RDS instance's security group to allow traffic only from the EC2 instance's security group.

D.Create a security group rule that references the EC2 instance's security group.

E.Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'.

AnswersA, E

Combines with endpoint policy.

Why this answer

To restrict access to an RDS database to only EC2 instances with a specific tag, options A and E are correct. Option A: Attach an IAM policy to the EC2 instance role that allows rds:Connect only if the request originates from a VPC Endpoint. This ensures that only instances that can reach the VPC Endpoint (which requires proper routing and security) can connect.

Option E: Create a VPC Endpoint for RDS and attach an IAM policy that uses the condition 'ec2:ResourceTag/Environment' : 'Production'. This uses IAM conditions to allow access only from instances with the specified tag. Option B is incorrect because resource-based policies are not supported for RDS instances.

Options C and D are incorrect because security groups do not support tag-based rules; they only filter based on IP addresses, ports, and other security groups.

Full explanation →

287

MCQmedium

A company uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances in private subnets. The security team wants to ensure that only the ALB can communicate with the EC2 instances. Which security group configuration should be applied to the EC2 instances?

A.Allow inbound HTTP traffic from the EC2 instances' own security group

B.Allow inbound HTTP traffic from 0.0.0.0/0

C.Allow inbound HTTP traffic from the VPC CIDR block

D.Allow inbound HTTP traffic from the ALB's security group

AnswerD

This ensures only the ALB can initiate traffic to the EC2 instances.

Why this answer

Security groups can reference other security groups as a source, allowing traffic only from resources associated with that security group. By specifying the ALB's security group as the source for inbound HTTP traffic, the EC2 instances will only accept traffic originating from the ALB, effectively restricting all other inbound traffic. This is a best practice for securing backend instances behind a load balancer.

Exam trap

The trap here is that candidates often confuse security group referencing with CIDR-based rules, mistakenly thinking that allowing the VPC CIDR (Option C) is sufficient, but this would allow any resource in the VPC, not just the ALB, to reach the EC2 instances.

How to eliminate wrong answers

Option A is wrong because allowing inbound HTTP traffic from the EC2 instances' own security group would permit traffic between the EC2 instances themselves, not from the ALB, and does not restrict access to the ALB only. Option B is wrong because allowing inbound HTTP traffic from 0.0.0.0/0 would permit traffic from any IP address on the internet, completely bypassing the ALB and exposing the EC2 instances directly. Option C is wrong because allowing inbound HTTP traffic from the VPC CIDR block would permit traffic from any resource within the VPC (including other EC2 instances, NAT gateways, or VPN connections), not exclusively from the ALB.

Full explanation →

288

Multi-Selectmedium

A company stores sensitive data in Amazon S3. The security team needs to ensure that data is encrypted at rest and that access is logged. Which TWO actions meet these requirements?

Select 2 answers

A.Enable VPC Flow Logs for the VPC

B.Enable S3 server access logs

C.Enable AWS CloudTrail to log data events

D.Enable default encryption on the S3 bucket

E.Enable AWS IAM Access Analyzer

AnswersB, D

Server access logs record requests to the bucket.

Why this answer

(Enable S3 server access logs) and Option D (Enable default encryption on the S3 bucket) are correct. Default encryption ensures data is encrypted at rest. Server access logs record requests to the bucket.

Option A is wrong because VPC Flow Logs capture network traffic, not S3 access. Option C is wrong because CloudTrail logs data events only if explicitly enabled. Option E is wrong because IAM Access Analyzer analyzes resource policies, not logging access.

Full explanation →

289

MCQhard

A company uses AWS KMS to encrypt data in Amazon S3. Security team wants to ensure that only specific IAM roles can decrypt objects. Which KMS key policy configuration should be used?

A.Attach an IAM policy to the role that allows kms:Decrypt, and leave the KMS key policy with default settings.

B.In the key policy, use a Principal element specifying the role ARN, and allow kms:Decrypt.

C.Use a grant for the role to allow kms:Decrypt for S3 operations.

D.In the key policy, use a Condition block with kms:ViaService set to s3.<region>.amazonaws.com and allow kms:Decrypt for the role.

AnswerD

This restricts decryption requests to come via S3 service, meeting the requirement.

Why this answer

Using a kms:ViaService condition in the key policy restricts the key usage to requests coming from Amazon S3, and the IAM role's permissions to decrypt are granted via the key policy, ensuring only that role can decrypt via S3. Option A is wrong because without the key policy granting decrypt to the role, the IAM policy alone is insufficient. Option B is wrong because it grants blanket decrypt access to the role without the S3 service restriction, allowing decryption outside S3.

Option C is wrong because grants are not the recommended way to control access for IAM roles with S3; key policies with conditions are more appropriate.

Full explanation →

290

MCQeasy

A company wants to allow an IAM user to manage only their own password in the AWS Management Console. Which IAM policy action should be used?

A.iam:ChangePassword

B.iam:ListUsers

C.iam:CreateAccessKey

D.iam:DeactivateMFADevice

AnswerA

Allows the user to change their own password.

Why this answer

The correct IAM policy action to allow a user to manage only their own password is iam:ChangePassword. This action enables the user to change their password in the AWS Management Console. Option A is correct.

Option B (iam:ListUsers) is used to list IAM users, not relevant to password management. Option C (iam:CreateAccessKey) creates access keys, which is unrelated. Option D (iam:DeactivateMFADevice) deactivates MFA devices, also not relevant.

Therefore, only iam:ChangePassword is appropriate.

Full explanation →

291

MCQmedium

A security engineer needs to ensure that all EC2 instances launched in an account have a specific tag (e.g., CostCenter) applied. If an instance is launched without the tag, it should be automatically terminated. Which solution meets these requirements with minimal effort?

A.Use an SCP to deny ec2:RunInstances if the request does not include the required tag.

B.Use AWS Organizations Tag Policies to enforce the tag.

C.Use AWS Config rules with an automatic remediation action that invokes a Lambda function to terminate the instance.

D.Use AWS CloudTrail to detect RunInstances events and send alerts to the security team.

AnswerC

Config can detect untagged instances and auto-remediate by terminating them.

Why this answer

AWS Config rules can detect EC2 instances that are missing the required tag and trigger an automatic remediation action via a Lambda function to terminate them, providing a fully automated solution with minimal effort. Option A is wrong because SCPs cannot enforce tagging on individual EC2 instances at launch time; they can only deny actions based on conditions, but tagging conditions are not supported for ec2:RunInstances. Option B is wrong because AWS Organizations Tag Policies enforce tagging on resources but do not automatically remediate non-compliant resources; they only prevent creation of resources without tags if applied at the service level, which is not the case here.

Option D is wrong because CloudTrail logs events but cannot automatically terminate instances; it would require manual intervention or additional automation.

Full explanation →

292

Multi-Selecteasy

A company wants to grant an IAM user the ability to manage (create and update) their own access keys. Which TWO IAM actions must be allowed in the policy?

Select 2 answers

A.iam:UpdateAccessKey

B.iam:CreateAccessKey

C.iam:GetAccessKeyLastUsed

D.iam:DeleteAccessKey

E.iam:ListAccessKeys

AnswersA, B

Allows activation and deactivation of access keys; required for update.

Why this answer

To allow a user to manage (create and update) their own access keys, the policy must include iam:CreateAccessKey and iam:UpdateAccessKey. These actions enable the user to generate new keys and activate/deactivate them. iam:DeleteAccessKey is not required for this specific scope.

Full explanation →

293

MCQeasy

A company has enabled AWS CloudTrail and wants to receive real-time notifications when specific API calls, such as DeleteTrail, are made. Which service should be used to trigger an alert based on CloudTrail log events?

A.AWS CloudTrail console notifications

B.Amazon CloudWatch Events / Amazon EventBridge

C.Amazon VPC Flow Logs

D.Amazon S3 event notifications

AnswerB

EventBridge can match CloudTrail events and trigger actions like SNS notifications.

Why this answer

Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service to trigger real-time alerts based on CloudTrail log events. You can create a rule that matches specific API calls, such as DeleteTrail, and route the event to a target like an SNS topic or Lambda function for immediate notification. CloudTrail delivers log events to CloudWatch Logs, and EventBridge can directly consume those events for pattern matching and alerting.

Exam trap

The trap here is that candidates often confuse S3 event notifications (which work on S3 objects) with CloudTrail log delivery to S3, mistakenly thinking S3 notifications can parse CloudTrail logs for specific API calls, but S3 notifications only react to bucket-level object events, not the content of log files.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail console notifications do not exist as a feature; CloudTrail does not provide built-in real-time alerting from its console. Option C is wrong because Amazon VPC Flow Logs capture IP traffic metadata (source/destination IPs, ports, protocols) and are not designed to monitor or alert on CloudTrail API call events. Option D is wrong because Amazon S3 event notifications are triggered by object-level operations (e.g., PutObject, DeleteObject) in an S3 bucket, not by CloudTrail log events or API calls like DeleteTrail.

Full explanation →

294

MCQeasy

A company has an incident response (IR) process that includes isolating compromised EC2 instances. During a security incident, the IR team needs to block all traffic to and from a compromised instance while preserving the instance for forensic analysis. Which approach should the team take?

A.Detach the instance from the Auto Scaling group and stop it.

B.Modify the security group associated with the instance to remove all inbound and outbound rules.

C.Update the network ACL for the subnet to deny all traffic.

D.Terminate the instance immediately.

AnswerB

Modifying the instance's security group to remove all inbound and outbound rules is the correct containment step because security groups are instance-level stateful firewalls, and deleting every rule immediately terminates existing and new connections while leaving the instance powered on. This preserves volatile memory and running processes for live forensics, and because the change applies only to that security group, other instances and the overall subnet remain unaffected. It is preferable to a NACL change, which would block traffic to the entire subnet.

Why this answer

Modifying the security group to remove all inbound and outbound rules effectively blocks all traffic to and from the EC2 instance because security groups act as a stateful virtual firewall at the instance level. This approach preserves the instance in its current running state, allowing the IR team to perform forensic analysis without the risk of the instance being tampered with or communicating with external systems.

Exam trap

The trap here is that candidates often confuse security groups (stateful, instance-level) with network ACLs (stateless, subnet-level) and incorrectly assume that updating the NACL is the correct way to isolate a single instance without affecting other instances in the subnet.

How to eliminate wrong answers

Option A is wrong because detaching the instance from the Auto Scaling group and stopping it will halt the operating system and may trigger lifecycle hooks or termination policies, but it does not immediately block all network traffic during the stop process; additionally, stopping an instance can cause loss of volatile memory data critical for forensic analysis. Option C is wrong because updating the network ACL for the subnet denies traffic at the subnet level, but network ACLs are stateless and require explicit rules for both inbound and outbound traffic; moreover, the compromised instance could still communicate with other instances within the same subnet if the subnet's default rules allow it, and NACL changes affect all instances in the subnet, potentially disrupting other workloads. Option D is wrong because terminating the instance immediately destroys the instance and its attached EBS volumes (unless termination protection is enabled and volume deletion is disabled), making forensic analysis impossible and violating the requirement to preserve the instance for investigation.

Full explanation →

295

MCQmedium

The above condition is added to an S3 bucket policy to restrict access to a specific VPC endpoint. An EC2 instance in the same VPC is unable to access the bucket. What is the most likely reason?

A.The condition should use aws:SourceVpc instead of aws:SourceVpce

B.The EC2 instance does not have a public IP address

C.The VPC endpoint policy does not allow the s3:GetObject action

D.The resource ARN in the policy is for EC2, not for S3

AnswerD

S3 bucket policies are resource-based policies attached to a bucket, so the Resource field must use the S3 ARN format arn:aws:s3:::bucket-name (or an object key pattern). Using an EC2 resource ARN, such as arn:aws:ec2:region:account-id:instance/instance-id, makes the policy invalid for S3 and therefore it does not grant or restrict access. This is the fundamental reason the bucket policy fails, regardless of any condition keys or endpoint configuration.

Why this answer

The resource ARN in the policy must reference the S3 bucket (e.g., arn:aws:s3:::bucket-name/*), not an EC2 resource. If the ARN is for EC2, the policy will not apply to S3 operations, causing the EC2 instance to be denied access regardless of the VPC endpoint condition. S3 bucket policies only take effect when the Resource element specifies the S3 bucket ARN.

Exam trap

The trap here is that candidates focus on the VPC endpoint condition (aws:SourceVpce vs aws:SourceVpc) and overlook the fundamental requirement that the Resource ARN must match the S3 bucket, not the EC2 instance.

How to eliminate wrong answers

Option A is wrong because aws:SourceVpce is the correct condition key to restrict access to a specific VPC endpoint; aws:SourceVpc is used to restrict to an entire VPC, not a specific endpoint, so using aws:SourceVpce is valid and not the cause of the failure. Option B is wrong because an EC2 instance accessing S3 via a VPC endpoint does not require a public IP address; traffic stays within the AWS network and uses private IPs. Option C is wrong because the VPC endpoint policy, if not explicitly denying s3:GetObject, would default to allowing it; the issue is with the bucket policy, not the endpoint policy.

Full explanation →

296

MCQmedium

A company stores sensitive data in an S3 bucket with default encryption (SSE-S3) enabled. A security audit reveals that objects are being accessed by users from unexpected IP addresses. The company wants to enforce that only objects encrypted with a specific KMS key (managed by the security team) can be accessed. Which combination of actions should be taken?

A.Use SSE-C and distribute the customer key to authorized users only.

B.Modify the bucket policy to deny PutObject and GetObject unless the request includes the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header.

C.Enable S3 Block Public Access and use AWS WAF to filter IP addresses.

D.Apply an S3 Lifecycle policy to transition objects to Glacier after 30 days.

AnswerB

This enforces use of the specific KMS key for all operations.

Why this answer

It uses a bucket policy with the 's3:x-amz-server-side-encryption-aws-kms-key-id' condition key to deny requests that do not include the specific KMS key ID in the 'x-amz-server-side-encryption-aws-kms-key-id' header. This enforces that only objects encrypted with the specified KMS key can be accessed. Option A is incorrect because SSE-C uses customer-provided keys and does not integrate with KMS key IDs; distributing a customer key does not enforce the specific KMS key.

Option C is incorrect because S3 Block Public Access and AWS WAF do not control access based on encryption key. Option D is incorrect because lifecycle policies do not restrict access based on encryption key.

Full explanation →

297

MCQhard

A company uses AWS Organizations with multiple accounts. They want to centralize logging of all API calls across all accounts and store them in a single S3 bucket. Which configuration should be used?

A.Use AWS Config to record API calls across all accounts

B.Create a separate CloudTrail trail in each account and aggregate logs using Amazon Athena

C.Create an organization trail in the management account

D.Enable VPC Flow Logs in each account and send to a central S3 bucket

AnswerC

Organization trails log events for all accounts and deliver to a single bucket.

Why this answer

AWS Organizations allows you to create an organization trail in the management account that automatically logs API calls for all member accounts. This centralizes CloudTrail logs into a single S3 bucket without needing to configure individual trails per account, ensuring complete coverage and simplified management.

Exam trap

The trap here is that candidates often confuse AWS Config (which records configuration changes) with CloudTrail (which records API calls), or they think VPC Flow Logs can substitute for API logging, leading them to select options that do not meet the requirement for centralized API call logging.

How to eliminate wrong answers

Option A is wrong because AWS Config records resource configuration changes, not API calls; it does not capture the detailed API activity that CloudTrail provides. Option B is wrong because while separate trails per account can send logs to a central bucket, this approach is redundant and harder to manage compared to an organization trail, and Athena is a query service, not a logging aggregation service. Option D is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols), not API calls; they are used for network analysis, not API activity logging.

Full explanation →

298

MCQhard

A security engineer is designing a multi-tier web application on AWS. The web tier must be accessible from the internet, but the application tier should be accessible only from the web tier. The database tier should be accessible only from the application tier. Which combination of security groups provides the MOST secure configuration?

A.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG CIDR. DB SG: allow MySQL from App SG CIDR.

B.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow all traffic from Web SG. DB SG: allow MySQL from App SG.

C.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from 10.0.0.0/24.

D.Web SG: allow HTTP/HTTPS from 0.0.0.0/0. App SG: allow HTTP from Web SG security group ID. DB SG: allow MySQL from App SG security group ID.

AnswerD

Security group references ensure only instances in the web tier can access the app tier, and only instances in the app tier can access the database.

Why this answer

It uses security group IDs as the source for inbound rules, which allows traffic only from instances associated with the specified security group, regardless of their IP addresses. This provides a dynamic and secure way to control traffic between tiers, as security group IDs are resolved at the instance level and automatically adapt to changes in instance membership. By contrast, using CIDR blocks (as in options A and C) is less secure because it relies on static IP ranges that may not accurately reflect the actual instances in the web or app tiers, and option B is overly permissive by allowing all traffic from the web SG.

Exam trap

The trap here is that candidates often choose CIDR-based rules (options A or C) because they seem simpler, but they fail to recognize that security group IDs provide a more secure and dynamic way to enforce tier-to-tier access, especially in environments with elastic IPs or auto-scaling.

How to eliminate wrong answers

Option A is wrong because it uses CIDR blocks (Web SG CIDR) instead of security group IDs, which is less secure as CIDR blocks can be broader than necessary and do not automatically update when instances change IPs. Option B is wrong because it allows all traffic from the Web SG to the App SG, which is overly permissive and violates the principle of least privilege by permitting unnecessary protocols beyond HTTP. Option C is wrong because it uses a static CIDR block (10.0.0.0/24) for the database tier, which does not restrict access solely to the app tier instances and may allow other resources in that subnet to reach the database.

Full explanation →

299

MCQhard

A financial services company uses a multi-account AWS organization with a centralized security account. The security team has enabled Amazon GuardDuty in all accounts and configured it to send findings to the security account via AWS Organizations. The team also uses AWS Security Hub in the security account to aggregate findings. They have set up automated response using AWS Systems Manager Automation documents to isolate compromised EC2 instances by applying a security group that denies all traffic. However, during a recent incident, the automation failed because the Systems Automation document did not have permission to modify the security group in the member account. The security team needs to design a solution that allows the security account to automatically isolate instances in any member account. What should they do?

A.Create a Lambda function in each member account that is triggered by GuardDuty findings and modifies the security group.

B.Create a single IAM role in the security account that has permissions to modify security groups in all member accounts.

C.Use AWS CloudFormation StackSets to deploy an IAM role in each member account with permissions to modify security groups. Then, in the security account, configure the Systems Manager Automation document to assume that role when running the isolation step.

D.Modify the IAM role used by Systems Manager Automation in the security account to include permissions to modify security groups in all member accounts.

AnswerC

AWS CloudFormation StackSets deploys the same IAM role template to every member account, and the role is configured with a trust policy that allows the Systems Manager Automation execution role in the security account to assume it. The automation document uses the 'assumeRole' parameter in a step such as aws:executeScript to switch to that member account role, then runs the EC2 ModifySecurityGroup API against local resources. Because StackSets is integrated with AWS Organizations, the role is automatically provisioned when new accounts are added, centralizing governance while keeping permissions scoped per account.

Why this answer

It uses AWS CloudFormation StackSets to deploy an IAM role in each member account with the necessary permissions to modify security groups. The Systems Manager Automation document in the security account can then assume this role via a cross-account IAM role assumption, allowing it to isolate EC2 instances in any member account without requiring a single monolithic role or per-account Lambda functions.

Exam trap

The trap here is that candidates often assume a single IAM role in the security account can be granted permissions across all member accounts via resource-based policies, but in reality, cross-account access requires a role in the target account that trusts the source account, not just permissions on the source role.

How to eliminate wrong answers

Option A is wrong because creating a Lambda function in each member account triggered by GuardDuty findings would bypass the existing Systems Manager Automation workflow and introduce unnecessary complexity and duplication, rather than enabling the existing automation to work cross-account. Option B is wrong because a single IAM role in the security account cannot directly modify resources in member accounts; cross-account access requires the member account to trust the security account role via an IAM role in the member account with a trust policy. Option D is wrong because modifying the IAM role used by Systems Manager Automation in the security account to include permissions to modify security groups in all member accounts violates the principle of least privilege and is not technically feasible—AWS IAM roles are scoped to a single account and cannot grant permissions to resources in other accounts without a trust relationship and role assumption.

Full explanation →

300

Multi-Selectmedium

A company needs to encrypt data at rest for an Amazon RDS for Oracle database. The database is deployed in a Multi-AZ configuration. The company also wants to encrypt automated backups and snapshots. Which TWO steps should the security team take?

Select 2 answers

A.Enable encryption at rest when launching the RDS instance.

B.Modify the DB instance to enable encryption after creation.

C.Ensure that the 'Encryption at rest' setting also encrypts automated backups and snapshots.

D.Enable encryption at rest on the existing RDS instance via a modification.

E.Specify a KMS key after the instance is launched.

AnswersA, C

Encryption must be enabled at launch.

Why this answer

Encryption must be enabled at launch; it cannot be added later. Option C is correct because enabling encryption at rest automatically encrypts backups and snapshots. Option B is wrong because encryption cannot be enabled on an existing unencrypted instance.

Option D is wrong because encryption must be enabled at launch, not after. Option E is wrong because KMS key must be specified at launch; can be changed later only for certain engines.

Full explanation →

Page 4 of 6

All pages

Practice SCS-C02 by domain

Target a specific domain to shore up weak areas.

Threat Detection and Incident Response Security Logging and Monitoring Identity and Access Management Management and Security Governance Infrastructure Security Data Protection

See all domains with question counts →