AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 226–300

Option B is correct because the bucket policy allows public read access to all objects. Option A is wrong because MFA Delete is enabled, which is good. Option C is wrong because lifecycle policy does not delete current versions.

Option D is wrong because versioning is enabled.

Option C is correct because SCPs do not affect the management account; the management account is exempt from SCPs. Option A is wrong because IAM policies are account-specific; the SCP should still apply if attached. Option B is wrong because SCPs do not require explicit allow for all actions; they work by deny.

Option D is wrong because the condition key for tags is 'aws:RequestTag', not 'aws:ResourceTag'.

Option B is correct because metric filters are evaluated on incoming log events, not on historical data. If the error pattern existed before the filter was created, it will not be counted. Option A is wrong because the filter can be created after logs are ingested.

Option C is wrong because the metric namespace does not affect filtering. Option D is wrong because the log group retention does not affect metric evaluation.

Option D is correct because RDS MySQL supports general logs and audit logs that can capture login attempts. Enabling the '--log_queries_not_using_indexes' parameter logs queries without indexes, not login attempts. Option B is wrong because VPC Flow Logs capture network traffic.

Option C is wrong because CloudTrail does not log database-level events.

Option B is correct because AWS STS is used to issue temporary credentials. Option A is incorrect because IAM is for managing users and roles, not issuing temporary credentials. Option C is incorrect because AWS Cognito is for identity pools but uses STS internally; the direct service is STS.

Option D is incorrect because AWS KMS is for encryption keys.

RDS supports encryption at rest using KMS. To use a customer-managed HSM, you can use AWS CloudHSM with a custom key store in KMS. Option C is correct.

Option A is incorrect because RDS does not directly integrate with CloudHSM. Option B is incorrect because the default key is AWS managed. Option D is incorrect because RDS does not support client-side encryption for at-rest data.

Options B and C are correct. B: A bucket policy can grant cross-account access to a specific user. C: A role in Account B can be assumed by the user in Account A.

Option A is wrong because IAM users cannot be granted access directly to resources in other accounts via an IAM policy in their own account; the resource account must also grant access. Option D is wrong because the S3 bucket cannot have an IAM policy; it uses bucket policies. Option E is wrong because SCPs are used in AWS Organizations to set permissions boundaries, not to grant access.

Options B and D are correct. Option B is correct because CloudTrail delivers events to CloudWatch Logs, and CloudWatch Alarms can trigger on metric filters. Option D is correct because EventBridge can process CloudTrail events and trigger alerts.

Option A is wrong because IAM is for identity management, not monitoring. Option C is wrong because Config is for compliance evaluation, not real-time alerting on API calls. Option E is wrong because KMS is for encryption key management.

Enabling S3 Object Lock in governance mode provides immutability for logs against deletion or overwrite. Option A is correct. Option B is wrong because MFA Delete alone does not prevent overwrites.

Option C is wrong because bucket policies do not prevent deletion by authorized users. Option D is wrong because enabling versioning alone does not prevent deletion of all versions.

Option A is correct because CloudTrail can be configured to send events to CloudWatch Logs, and a CloudWatch metric filter can detect root account activity, triggering an SNS notification. Option B is wrong because GuardDuty does not specifically monitor root account usage. Option C is wrong because Config records resource changes, not API calls.

Option D is wrong because S3 server access logs are for S3 access, not root usage.

Option A (S3 bucket policy with aws:SourceVpc condition) and Option C (VPC endpoint for S3) are correct. The bucket policy with the aws:SourceVpc condition restricts access to requests originating from the specified VPC, and the VPC endpoint allows private connectivity to S3 from that VPC. Option B (Internet gateway) would allow public access.

Option D (NAT gateway) is for outbound traffic. Option E (Security group on S3) is not applicable.

Option B is correct because GuardDuty can analyze VPC Flow Logs and DNS logs to detect brute force attempts. Option A is wrong because CloudTrail does not monitor network traffic. Option C is wrong because Inspector is for vulnerability scanning.

Option D is wrong because Config is for configuration compliance. Option E is wrong because Shield is for DDoS protection.

The assumed role credentials have an expiration time. If the terminate-instances command is run after expiration, it will fail with UnauthorizedOperation. Alternatively, if the instance is not in the specified region or account, it would also fail.

Given the exhibit shows expiration time, option D is most likely.

Option B is correct because CloudTrail logs all KMS API calls, and CloudWatch Alarms can trigger alerts on specific events. Option A is wrong because GuardDuty focuses on threat detection, not specific API calls. Option C is wrong because Config monitors resource configurations, not API calls.

Option D is wrong because Inspector is for vulnerability assessment.

Option B is correct because the iptables INPUT chain has a default DROP policy. The rules only allow HTTP (port 80) from the 10.0.0.0/16 subnet, but the user's IP is 203.0.113.5, which is not in that range. Therefore, the packet is dropped by iptables.

Option A is wrong because even though the security group allows HTTP, iptables drops it. Option C is wrong because SSH is allowed only from anywhere, but the request is HTTP. Option D is wrong because the security group allows HTTP, but iptables overrides.

Option C is correct because the KMS key policy must grant the engineer's role kms:Decrypt permission. Option A is wrong because the error is not about S3 permissions. Option B is wrong because S3 bucket policy does not control KMS permissions.

Option D is wrong because CloudTrail does not need decrypt permission for reading logs.

Option A and Option E are correct. To rotate access keys, the user needs to create a new key and delete the old one. Option B is wrong because UpdateAccessKey can change the status (Active/Inactive) but is not required for rotation.

Option C is wrong because ListAccessKeys is not strictly necessary; it helps but is not required. Option D is wrong because GetAccessKeyLastUsed is not needed.

GuardDuty can send findings to EventBridge, which triggers a Lambda function to modify the security group. Option A is wrong because GuardDuty does not have native remediation actions. Option C is wrong because Systems Manager Automation is possible but requires a runbook.

Option D is wrong because AWS Config does not react to GuardDuty findings.

Option D is correct because security groups for ECS tasks in awsvpc mode can control inbound/outbound traffic. Option A is wrong because IAM policies control API calls, not network traffic. Option B is wrong because network ACLs are stateless and applied at subnet level, not per task.

Option C is wrong because VPC endpoints are for accessing AWS services, not for container communication.

Option C is correct because if the S3 bucket is using SSE-KMS encryption, CloudTrail requires explicit permissions to use the KMS key. Option A is wrong because CloudTrail can deliver logs to buckets in different accounts with proper cross-account permissions. Option B is wrong because management events are logged by default.

Option D is wrong because the bucket policy is not missing.

Option D is correct because a network ACL (NACL) can override security group rules if it denies inbound traffic. Option A is wrong because security groups are stateful; the inbound rule would allow traffic. Option B is wrong because if the NACL allowed traffic, it wouldn't explain the restriction.

Option C is wrong because security group rules are evaluated; the rule allowing all traffic would still apply.

Option B is correct because permission sets in IAM Identity Center define collections of policies that can be assigned to users and groups across accounts. Option A is for managing access to external applications. Option C is for federation.

Option D is for account management.

Option D is correct because CloudTrail logs API calls and can deliver them to an encrypted S3 bucket. Option A is wrong because CloudWatch Logs does not directly store logs in S3. Option B is wrong because Config records resource changes, not API calls.

Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Option B is correct because CloudWatch Events can filter specific API calls and trigger a Lambda function to send notifications. Option A is incorrect because CloudTrail does not natively send alerts; it delivers logs to S3. Option C is incorrect because CloudWatch Logs Insights requires querying logs manually, not real-time alerting.

Option D is incorrect because Config records resource changes but is not optimized for API call alerts.

Option C is correct because a VPC endpoint policy with aws:SourceVpce condition key restricts access to traffic coming through the specified VPC endpoint. Option A is wrong because aws:SourceVpc does not restrict to a specific endpoint. Option B is wrong because aws:SourceIp does not apply to VPC endpoint traffic.

Option D is wrong because aws:VpcSourceIp is not a valid condition key for VPC endpoints.

Option C is correct because VPC Flow Logs capture IP traffic metadata but not DNS queries. AWS CloudTrail does not capture DNS queries. Amazon GuardDuty is a threat detection service.

AWS Network Firewall can capture DNS logs. Option A is wrong because VPC Flow Logs do not include DNS query details. Option B is wrong because CloudTrail records API calls, not DNS queries.

Option D is wrong because GuardDuty uses DNS logs from other sources.

Option D is correct because AWS CloudTrail logs all KMS Decrypt API calls. Option A is wrong because S3 server access logs record requests to S3, not the KMS decryption calls. Option B is wrong because CloudWatch Logs can store logs but does not generate them.

Option C is wrong because AWS Config records configuration changes, not API calls.

Options B, C, and D are correct. The AWS SDK Encryption Client (B) handles client-side encryption. The client must call KMS to generate a data key (C).

The encrypted data key is stored with the object (D). Option A is wrong because the KMS key policy is not required for client-side encryption; the client needs IAM permissions. Option E is wrong because the S3 bucket policy is not required for client-side encryption.

Option C is correct because network ACLs are stateless and must allow both inbound and outbound traffic for the connection. Even if security groups allow traffic, a network ACL can block it. Option A is wrong because route tables handle routing, not filtering.

Option B is wrong because VPC flow logs only monitor traffic, not block it. Option D is wrong because the default VPC has a default network ACL that allows all traffic, but custom ACLs may have restrictive rules.

A bucket policy with a condition on aws:SecureTransport denies non-HTTPS requests. Option A is wrong because it refers to encryption at rest. Option C is wrong because it denies all requests.

Option D is wrong because it denies HTTPS traffic, which is the opposite.

Option A is correct because the condition likely specifies 'ec2:InstanceType' equals 't2.micro', so if the user tries to launch any other type, the action is denied. Option B is irrelevant because the policy allows the action. Option C is not a common condition.

Option D is unrelated.

AWS Config rules can evaluate resources against desired configurations. A custom AWS Config rule using a Lambda function can check security group rules and trigger notifications via SNS. Option A is wrong because CloudTrail logs API calls but requires parsing.

Option C is wrong because IAM Access Analyzer focuses on resource policies. Option D is wrong because GuardDuty is for threat detection.

Option C is correct. SCPs do not affect the management account; they only apply to member accounts. If the production account is the management account, SCPs will not apply.

Option A is incorrect because SCPs don't require explicit allow; they deny by default if not allowed. Option B is incorrect because SCPs affect all IAM principals in the account. Option D is incorrect because SCPs can be applied to OUs.

Option B is correct because deactivating the user in the identity provider (IdP) will invalidate all sessions and prevent new ones. Option A is wrong because deleting the IAM user in each account is inefficient. Option C is wrong because removing from groups in AWS SSO may not immediately revoke active sessions.

Option D is wrong because deleting the IAM role would break access for other users.

Option C is correct because the NAT gateway must have an associated Elastic IP to communicate with the internet. Option A is wrong because the security group of the NAT gateway must allow outbound traffic, but the default is permissive. Option B is wrong because the NAT gateway itself does not need a route to the internet gateway; its public subnet does.

Option D is wrong because security groups are not applied to NAT gateways in the same way; they are applied to the ENI.

Option A is correct because S3 Batch Operations can copy objects in place, preserving versions and applying new encryption. Option B is wrong because lifecycle policies do not re-encrypt. Option C is wrong because S3 sync does not handle versioning.

Option D is wrong because the S3 console does not have a bulk re-encrypt feature for versions.

Options B and D are correct. A CloudFormation Stack Policy (B) can enforce encryption settings. AWS Config rules (D) can detect and remediate non-compliant buckets.

Option A is wrong because S3 Block Public Access does not enforce encryption. Option C is wrong because SCPs apply to accounts, not CloudFormation stacks. Option E is wrong because IAM roles do not enforce encryption on S3 buckets.

Option C is correct because enabling S3 server access logs captures all requests, and Amazon GuardDuty can detect suspicious activity in real time. Option A is wrong because CloudTrail management events do not log data events by default. Option B is wrong because VPC Flow Logs do not log S3 access.

Option D is wrong because AWS Config is for configuration changes, not real-time threat detection.

Options A and D are valid uses. Option B is incorrect because permissions boundaries don't delegate administration. Option C is incorrect because boundaries are applied to IAM entities, not resource-based policies.

Option E is incorrect because cross-account access is governed by trust policies, not boundaries.

Option C is correct because CloudHSM supports copying backups across regions using the AWS CLI or console, which is secure and efficient. Option A is incorrect because exporting keys directly is not supported; backups are used. Option B is incorrect because manual copy (e.g., scp) is not supported.

Option D is incorrect because cross-region replication does not apply to CloudHSM backups.

Option A is correct. The VPC route table needs a route for the on-premises CIDR pointing to the VGW. If this route is missing, traffic from the VPC to on-premises will not be routed correctly.

Option B is incorrect because security groups are stateful and allow return traffic. Option C is not required if the VPN is configured correctly. Option D is incorrect because the VGW is the correct target.

Option B is correct: attach an execution role to the Lambda function that includes permissions for logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Option A uses resource-based policy which is not typical for Lambda. Option C is overly permissive.

Option D uses user credentials, not best practice.

Option A is correct because the filter is by log group name, and the flow log created is for the entire VPC, not a subnet. The engineer may have created the flow log at the VPC level. Option B is wrong because the CLI command shows the flow log status as ACTIVE.

Option C is wrong because the role is valid. Option D is wrong because the flow log is delivering to CloudWatch Logs, which is a valid destination.

The correct answer is C because using AWS Systems Manager Session Manager allows SSH access without opening any inbound ports, and it uses IAM policies for access control. Option A is wrong because a NACL is stateless and would still require an inbound rule; also, NACLs are not a replacement for security group configuration. Option B is wrong because changing the port does not improve security; attackers scan all ports.

Option D is wrong because restricting to a single IP is better than open to all, but Session Manager is more secure as it eliminates inbound ports entirely.

Option B is correct because S3 Block Public Access settings at the account or bucket level can enforce that no new objects or ACLs grant public access. Option A is wrong because bucket policies can be circumvented if not enforced; Block Public Access is a preventative guardrail. Option C is wrong because Object Lock prevents deletion/overwrite but doesn't control public access.

Option D is wrong because default encryption only encrypts data at rest.

Option B is correct because enabling SSL/TLS on the RDS instance and requiring encrypted connections from the application encrypts data in transit. Option A is wrong because RDS does not natively support IPsec VPN. Option C is wrong because using a NAT gateway adds latency and does not encrypt the database connection.

Option D is wrong because AWS Certificate Manager is for load balancers and CloudFront, not for database connections.

Option D is correct because both a bucket policy in Account A allowing the user and an IAM policy in Account B granting s3:GetObject are required. Option A is wrong because bucket policy alone is insufficient. Option B is wrong because IAM policy alone is insufficient.

Option C is wrong because ACLs are legacy and less secure.

Option C is correct because placing a single NAT gateway in a public subnet and adding a default route to the NAT gateway in the private subnet route tables achieves the requirement. Option A is wrong because each private subnet needs its own route entry. Option B is wrong because using multiple NAT gateways defeats central management.

Option D is wrong because NAT gateways cannot be placed in private subnets.

Option A is correct: a service control policy (SCP) at the root or OU level can deny the IAM:CreateAccessKey action, which applies to all accounts in the organization. Option B is wrong because it does not prevent users in other accounts from creating keys. Option C is wrong because IAM Access Analyzer does not block actions.

Option D is wrong because it requires manual updates and is not scalable.

Option A is correct because it uses separate statements for read and write actions, with resource ARNs limited to the respective buckets, and does not include unnecessary actions. Option B grants s3:PutObject to the wrong bucket. Option C grants full S3 access.

Option D uses a wildcard for resources.

Option C is correct because Security Hub custom actions require an EventBridge rule to route findings to the Lambda function. Without the rule, Security Hub cannot invoke Lambda directly. Option A is wrong because the function's execution role permissions are for accessing other AWS resources, not for being invoked.

Option B is wrong because Security Hub findings are generated even if GuardDuty is enabled. Option D is wrong because the Lambda function's resource-based policy allows invocation from Security Hub, but Security Hub does not directly invoke Lambda; it uses EventBridge.

Option C is correct because the bucket policy denies all s3 actions if the request is not using HTTPS (SecureTransport is false). Since the engineer uses HTTP (no SSL), the condition matches and the upload is denied. Option A is wrong because the bucket does not have a default encryption setting.

Option B is wrong because the policy denies all actions, not just put. Option D is wrong because the policy denies, not allows.

Option A is correct because using a custom key store with CloudHSM ensures that KMS operations are performed in the HSM and key material is not exportable. Option B is wrong because symmetric keys do not leave the HSM, but the question asks to ensure it never leaves; custom key store already ensures that. Option C is wrong because asymmetric keys can be exported if the HSM allows.

Option D is wrong because disabling key export in KMS is not a direct setting; it's inherent in custom key stores.

CloudTrail logs all API calls, including AccessDenied errors. A CloudWatch metric filter on CloudTrail logs can trigger an alarm. Option C is correct.

Option A is wrong because IAM Access Analyzer is for external access analysis. Option B is wrong because Service Control Policies are for organizations. Option D is wrong because Config does not monitor API calls.