Courseiva

AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 301–375

376 questions total · 6pages · All types, answers revealed

Take a mock examExam hub
Page 4

Page 5 of 6

Page 6
301
Multi-Selectmedium

A security team is setting up incident response automation. Which TWO steps should be taken to ensure that a compromised EC2 instance is isolated while preserving forensic data? (Choose TWO.)

Select 2 answers
A.Assign a new security group that denies all inbound and outbound traffic.
B.Shut down the instance from the OS.
C.Remove the instance from any Auto Scaling group or load balancer target group.
D.Create an EBS snapshot of the instance's root volume.
E.Terminate the instance.
AnswersC, D

Stops new traffic.

Why this answer

Removing the instance from Auto Scaling groups or load balancer target groups stops new traffic from being routed to it, effectively isolating it from application traffic without destroying the instance. Option D is correct because creating an EBS snapshot preserves the root volume's data for forensic analysis before any changes occur. Together, these steps ensure the instance is isolated for investigation while retaining evidence.

Exam trap

The trap here is that candidates often choose Option A (assigning a deny-all security group) thinking it isolates the instance, but they overlook that existing connections remain active and that Auto Scaling may immediately launch a replacement, losing the forensic opportunity.

Full explanation →
302
MCQhard

A security engineer examines the above output. The company requires automatic yearly key rotation. What should the engineer do?

A.Run 'aws kms enable-key-rotation --key-id 1234abcd-12ab-34cd-56ef-1234567890ab'
B.Use AWS CloudHSM to generate a new key and rotate manually.
C.Replace the key with an AWS managed key.
D.Import a key material and enable automatic rotation.
AnswerA

This enables automatic yearly rotation for a customer managed key.

Why this answer

The key is a customer managed CMK (KeyRotationEnabled: false indicates it's not an AWS managed key, as AWS managed keys have rotation enabled automatically and cannot be disabled). Enabling automatic rotation on a customer managed CMK is done via the 'aws kms enable-key-rotation' CLI command. Option B is incorrect because AWS CloudHSM is not required for key rotation; automatic rotation can be enabled directly on the CMK without manual intervention.

Option C is incorrect because replacing the key with an AWS managed key would remove control over rotation and is not a necessary action; the current key can have rotation enabled. Option D is incorrect because if key material is imported, automatic rotation is not supported; the key must be rotated manually.

Full explanation →
303
Multi-Selecteasy

A company wants to ensure that all API calls made to AWS are logged for security analysis. Which TWO services can be used to achieve this? (Choose two.)

Select 2 answers
A.Amazon S3 server access logs
B.AWS CloudTrail
C.Amazon VPC Flow Logs
D.Amazon CloudWatch Logs
E.AWS Config
AnswersA, B

S3 server access logs record requests made to S3, which are a subset of API calls.

Why this answer

Amazon S3 server access logs capture detailed records of requests made to an S3 bucket, including the requester, bucket name, request time, and action. This enables security analysis of API calls specifically targeting S3 resources. AWS CloudTrail records all API calls made to the AWS Management Console, SDKs, and CLI across the entire AWS account, providing a comprehensive audit trail for security analysis.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (which log network traffic) or CloudWatch Logs (a log storage service) with services that directly capture API calls, but only CloudTrail and S3 server access logs provide the specific API-level logging required for security analysis.

Full explanation →
304
MCQhard

An organization uses AWS Organizations with hundreds of accounts. The security team wants to automatically respond to a specific GuardDuty finding by isolating the affected EC2 instance. What is the recommended architecture?

A.Use EventBridge to trigger a Lambda function in the delegated administrator account, which assumes an IAM role in the affected account to isolate the instance.
B.Configure GuardDuty to invoke a Lambda function in the affected account directly.
C.Use EventBridge to send the finding to a Step Functions workflow that isolates the instance.
D.Use AWS Systems Manager Automation to isolate the instance across accounts.
AnswerA

This is the AWS-recommended architecture for automated, cross-account GuardDuty response. GuardDuty publishes findings as EventBridge events, and because you are using a delegated administrator, you can centralize an EventBridge rule in that administrator account to capture findings from all member accounts. The triggered Lambda then assumes an IAM role in the specific affected member account (via the role's trust policy) to make the EC2 'isolate' API calls (e.g., stopping the instance or applying a security group) without requiring credentials stored in the Lambda. This pattern keep the response logic centralized, avoids per-account Lambda copies, and follows the secure cross-account role assumption model.

Why this answer

It follows the recommended architecture for cross-account automated response to GuardDuty findings. EventBridge in the delegated administrator account captures the finding and triggers a Lambda function, which then assumes an IAM role (using STS AssumeRole) in the affected member account to perform the isolation. This pattern centralizes management while respecting the security boundary between accounts.

Exam trap

The trap here is that candidates may assume GuardDuty can directly trigger a Lambda in any account, but in reality, GuardDuty findings are centralized in the delegated administrator account and cross-account actions require explicit role assumption via EventBridge and Lambda.

How to eliminate wrong answers

Option B is wrong because GuardDuty cannot directly invoke Lambda functions in member accounts; it can only send findings to EventBridge or to the delegated administrator account. Option C is wrong because while Step Functions can orchestrate workflows, the recommended architecture uses a Lambda function to assume a role in the affected account, not a direct Step Functions cross-account invocation (which would require additional complexity and is not the standard pattern). Option D is wrong because AWS Systems Manager Automation does not natively support cross-account isolation of EC2 instances without first assuming a role via Lambda or similar; the recommended approach uses EventBridge and Lambda, not Systems Manager Automation directly.

Full explanation →
305
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team needs to centrally monitor all API calls made in the member accounts. The team wants to ensure that all CloudTrail logs are delivered to a centralized S3 bucket in the management account. Which configuration should the security team implement?

A.Configure CloudWatch cross-account subscription to send logs from member accounts to the management account.
B.Enable CloudTrail in each member account and configure each trail to deliver logs to the same S3 bucket.
C.Create an organization trail in the management account with the S3 bucket in the management account.
D.Use Amazon S3 replication to copy logs from member account buckets to the management account bucket.
AnswerC

An organization trail is created only in the management account (or delegated administrator) and automatically applies to all accounts in the AWS organization, with no per-account setup required. It records management events across all accounts, including AWS Organizations control-plane operations like CreateAccount and AttachPolicy, and delivers the aggregated logs to a single S3 bucket in the management account. This is the correct way to centrally collect CloudTrail logs for governance and compliance.

Why this answer

AWS Organizations supports creating an organization trail in the management account that automatically applies to all member accounts. This ensures that all API calls from every account in the organization are logged and delivered to a centralized S3 bucket in the management account without needing to configure individual trails or manage cross-account permissions manually.

Exam trap

The trap here is that candidates often think they need to configure CloudTrail in each member account individually (Option B) or use S3 replication (Option D), missing the fact that AWS Organizations provides a native, centralized organization trail feature that automatically applies to all accounts.

How to eliminate wrong answers

Option A is wrong because CloudWatch cross-account subscription is designed for streaming log data to a central account for real-time monitoring, not for delivering CloudTrail logs to an S3 bucket; CloudTrail logs are stored in S3, not CloudWatch Logs by default. Option B is wrong because while it would technically deliver logs to the same S3 bucket, it requires manual configuration in each member account, does not leverage the centralized management capabilities of AWS Organizations, and can lead to permission issues or inconsistent configurations. Option D is wrong because S3 replication copies objects between buckets after they are written, but it introduces complexity, additional costs, and potential delays; it does not provide a native, centralized way to ensure all CloudTrail logs are delivered directly to the management account bucket without first storing them in member account buckets.

Full explanation →
306
MCQhard

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role has an attached policy that grants s3:GetObject on the bucket. However, the application on the EC2 instance is unable to read objects. What is the MOST likely cause?

A.The S3 bucket policy denies access to the IAM role.
B.The EC2 instance does not have an IAM instance profile configured.
C.The policy is attached to the EC2 instance instead of the role.
D.The EC2 instance is not running the latest user data script.
AnswerB

Without an instance profile, the role credentials are not available to the instance.

Why this answer

For an IAM role to be used by an EC2 instance, the role must be associated with an instance profile, and that profile must be attached to the instance. Without the instance profile, the instance cannot assume the role, so the application lacks the necessary permissions to read from S3. Option A is incorrect because the bucket policy denying access would be a possible cause, but it is not the most likely given that the role already has the s3:GetObject permission.

Option C is incorrect because policies are attached to roles, not instances directly. Option D is incorrect because the user data script does not affect IAM permissions.

Full explanation →
307
MCQmedium

A company is designing a VPC with public and private subnets. The web servers in the public subnets must be accessible from the internet on port 443, but the database servers in the private subnets should only be accessible from the web servers on port 3306. Which combination of security group rules and network ACL rules should be used to meet these requirements with the least administrative overhead?

A.Use security groups for all tiers; add an inbound rule to the database security group allowing traffic from the web security group on port 3306.
B.Use security groups for all tiers; add an inbound rule to the web security group allowing internet traffic on port 443, and add an outbound rule to the web security group allowing traffic to the database security group on port 3306.
C.Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing traffic from the web subnet CIDR on port 3306.
D.Use security groups for the web tier and network ACLs for the database tier; add an inbound rule to the database network ACL allowing all traffic from the web security group.
AnswerA

Security groups are stateful and support referencing other security groups as a source, allowing an inbound rule on the database security group to permit traffic only from instances associated with the web security group on port 3306. This removes the need to track instance IP addresses or rely on broad CIDR ranges, and it automatically scales with the web tier's launch or termination. Because security groups are stateful, return traffic from the database to the web tier is implicitly allowed, reducing operational overhead while maintaining least-privilege access.

Why this answer

Security groups are stateful and support referencing other security groups as a source, which allows you to permit traffic from the web security group to the database security group on port 3306 without needing to specify IP addresses. This approach minimizes administrative overhead as security group rules are automatically applied to all instances associated with the group, and changes propagate without updating network ACLs or CIDR ranges. The web security group can have an inbound rule allowing HTTPS (port 443) from the internet (0.0.0.0/0), while the database security group only allows inbound MySQL/Aurora (port 3306) from the web security group, meeting the access requirements precisely.

Exam trap

The trap here is that candidates often confuse the stateful nature of security groups with the stateless nature of network ACLs, leading them to incorrectly add outbound rules (Option B) or choose network ACLs (Options C and D) when security group references provide a simpler, more scalable solution.

How to eliminate wrong answers

Option B is wrong because it adds an outbound rule to the web security group for traffic to the database security group on port 3306, but security groups are stateful—if the inbound rule on the database security group allows traffic from the web security group, the return traffic is automatically permitted, making the outbound rule redundant and not the primary mechanism to restrict database access. Option C is wrong because it uses a network ACL for the database tier, which is stateless and requires separate inbound and outbound rules, increasing administrative overhead; additionally, referencing a subnet CIDR instead of a security group is less flexible and does not automatically adapt to changes in the web tier. Option D is wrong because network ACLs do not support referencing security groups as a source or destination—they only support CIDR blocks, IP addresses, or service prefixes, so the rule 'allowing all traffic from the web security group' is invalid and would not work.

Full explanation →
308
MCQhard

Refer to the exhibit. A security engineer reviews this CloudFormation template. The bucket is intended to be private. What is the security issue in the configuration?

A.The PublicAccessBlock configuration is missing the BlockPublicPolicy setting.
B.The bucket does not have versioning enabled.
C.The bucket policy grants public read access to the bucket, which overrides the PublicAccessBlock configuration.
D.The bucket policy uses an incorrect resource ARN.
AnswerA

The PublicAccessBlock configuration is missing the BlockPublicPolicy setting, so S3 does not reject the bucket policy that explicitly grants public read access. When BlockPublicPolicy is not enabled, a bucket policy allowing public access is evaluated as valid and takes effect, making the bucket publicly readable. Enabling BlockPublicPolicy would cause S3 to deny the policy request and preserve the bucket's private access, thereby eliminating the public exposure.

Why this answer

The PublicAccessBlock configuration in the template is missing the BlockPublicPolicy setting. Without BlockPublicPolicy enabled, a bucket policy that grants public read access (Effect: Allow, Principal: *, Action: s3:GetObject) can be applied to the bucket, overriding the intended private configuration. The other PublicAccessBlock settings (BlockPublicAcls, IgnorePublicAcls, RestrictPublicBuckets) do not block bucket policies; only BlockPublicPolicy does.

The security issue is that the bucket policy, though present, would be blocked if BlockPublicPolicy were enabled, but since it is missing, the bucket becomes publicly accessible.

Exam trap

The trap is that candidates assume any PublicAccessBlock setting prevents public access, but BlockPublicPolicy specifically blocks bucket policies. Without it, a bucket policy granting public access can be applied, making the bucket public despite other PublicAccessBlock settings.

How to eliminate wrong answers

Option A is wrong because the PublicAccessBlock configuration includes BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets; the template shows BlockPublicPolicy set to true, so it is not missing. Option B is wrong because versioning is a data protection and recovery feature, not a security control for preventing public access; its absence does not cause the bucket to be publicly readable. Option D is wrong because the resource ARN arn:aws:s3:::my-bucket/* correctly specifies all objects in the bucket, and the bucket name matches the logical ID; the ARN is valid for the policy statement.

Full explanation →
309
MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all new S3 buckets created in any account in the organization are encrypted with a specific KMS key. Which approach should be used?

A.Set up AWS Config rules to detect non-compliant buckets
B.Apply a Service Control Policy (SCP) that denies s3:CreateBucket unless encryption is configured
C.Create an IAM role that requires encryption and attach it to all users
D.Use an S3 bucket policy with a condition for encryption
AnswerB

SCPs can deny actions based on conditions, enforcing encryption at creation time.

Why this answer

Service Control Policies (SCPs) in AWS Organizations can centrally deny the creation of S3 buckets unless specific encryption conditions are met. By using an SCP with a condition that requires `s3:x-amz-server-side-encryption-aws-kms-key-id` to match the specific KMS key ARN, the security team can enforce encryption at the organizational level, preventing any account from creating non-compliant buckets regardless of IAM permissions.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config) with preventive controls (SCPs), or mistakenly think S3 bucket policies can govern bucket creation, when in fact bucket policies only apply to operations on existing buckets.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective, not preventive; they can detect non-compliant buckets after creation but cannot block the creation itself, leaving a window of non-compliance. Option C is wrong because IAM roles attached to users do not enforce encryption on S3 bucket creation across all accounts in the organization; users can still create buckets without encryption if they have direct S3 permissions or use other roles, and IAM roles cannot override permissions granted by other policies. Option D is wrong because S3 bucket policies are resource-based and apply only to existing buckets, not to the creation of new buckets; they cannot prevent a bucket from being created without encryption.

Full explanation →
310
MCQhard

A company is migrating on-premises data to AWS using AWS Snowball Edge. The data must be encrypted in transit and at rest. Which combination of steps should be taken?

A.Encrypt the data with a client-side tool before copying to Snowball Edge.
B.Set up a VPN connection to AWS and transfer data over the VPN.
C.Use AWS KMS to generate a key and apply it to the Snowball Edge device.
D.Use Snowball Edge with default encryption settings; data is encrypted at rest and in transit.
AnswerD

Correct. Snowball Edge encrypts data at rest with AES-256 and in transit with TLS.

Why this answer

Snowball Edge automatically encrypts data at rest using AES-256 and uses TLS for data in transit. Option A is incorrect because client-side encryption is not required; Snowball Edge handles encryption automatically. Option B is incorrect because Snowball Edge transfers data via its own secure protocol, not VPN.

Option C is incorrect because KMS is not directly used for Snowball encryption; the device manages its own encryption keys.

Full explanation →
311
MCQmedium

A security engineer is setting up a new VPC with public and private subnets. The VPC has an Internet Gateway attached. The public subnet's route table has a default route (0.0.0.0/0) pointing to the Internet Gateway. The private subnet's route table has a default route pointing to a NAT gateway. The engineer launches an EC2 instance in the private subnet and assigns it a public IP address. However, the instance cannot access the internet. What should the engineer do to resolve this issue?

A.Attach an Elastic IP to the instance.
B.Update the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway.
C.Remove the public IP address from the instance and ensure the private subnet has a route to the NAT gateway.
D.Allow outbound traffic in the instance's security group.
AnswerC

Private subnet instances should not have public IPs; they use NAT gateway for internet access.

Why this answer

An EC2 instance in a private subnet cannot use a public IP address for internet access, as the private subnet's route table directs default traffic to a NAT gateway, not an internet gateway. The public IP is irrelevant because the instance's traffic must traverse the NAT gateway, which requires the instance to have no public IP and the private subnet route to point to the NAT gateway. Removing the public IP ensures the instance uses the NAT gateway's Elastic IP for outbound traffic, resolving the internet access issue.

Exam trap

The trap here is that candidates mistakenly think assigning a public IP or Elastic IP to an instance in a private subnet will grant internet access, overlooking that routing decisions are made at the subnet level, not the instance level.

How to eliminate wrong answers

Option A is wrong because attaching an Elastic IP to the instance does not change the routing; the private subnet's route table still sends 0.0.0.0/0 traffic to the NAT gateway, and the Elastic IP would be ignored since the instance is behind a NAT gateway. Option B is wrong because updating the private subnet's route table to point 0.0.0.0/0 to the Internet Gateway would expose the instance directly to the internet, defeating the purpose of a private subnet and violating security best practices. Option D is wrong because security groups are stateful and allow outbound traffic by default; the issue is routing, not firewall rules.

Full explanation →
312
MCQhard

A company uses AWS Organizations with multiple accounts. The security team wants to detect suspicious API activity across all accounts in real time. They have enabled AWS CloudTrail in all accounts and are sending logs to a centralized S3 bucket. However, they are receiving alerts only after a significant delay. What should the security team do to reduce the latency of threat detection?

A.Set up Amazon EventBridge rules in each account to send specific CloudTrail events to a centralized event bus for immediate processing.
B.Enable Amazon GuardDuty in each account and configure it to send findings to a centralized S3 bucket.
C.Configure CloudTrail to deliver logs to a single S3 bucket and use S3 Event Notifications to trigger a Lambda function.
D.Use Amazon CloudWatch Logs Insights to query CloudTrail logs across accounts in real time.
AnswerA

This is the correct approach because Amazon EventBridge can ingest CloudTrail API calls in near real time via the default event bus in each account. You can then attach a rule that matches specific CloudTrail event names (e.g., ConsoleLogin, CreateAccessKey) and routes them to a centralized event bus in a monitoring account using an EventBridge cross-account target. This enables immediate, event-driven processing through AWS Lambda, Step Functions, or SNS, and avoids the multi-minute batching delays inherent in CloudTrail S3 delivery.

Why this answer

Amazon EventBridge can be configured with rules in each account to forward specific CloudTrail events to a centralized event bus in near real time, bypassing the latency introduced by CloudTrail log delivery to S3 (which can be up to 15 minutes). This allows the security team to process and alert on suspicious API activity immediately as events occur, rather than waiting for log files to be delivered and processed.

Exam trap

The trap here is that candidates often assume CloudTrail logs in S3 are the only source for threat detection, overlooking that EventBridge can ingest CloudTrail events in real time without waiting for S3 log delivery.

How to eliminate wrong answers

Option B is wrong because Amazon GuardDuty generates findings based on its own threat detection models, not on real-time CloudTrail events, and sending findings to an S3 bucket introduces similar delivery latency (up to 5 minutes for GuardDuty findings). Option C is wrong because S3 Event Notifications are typically invoked after CloudTrail delivers log files to the bucket, which can have a delay of several minutes, and they are not designed for sub-second real-time event processing. Option D is wrong because Amazon CloudWatch Logs Insights is a query tool for historical log analysis, not a real-time streaming or alerting mechanism; it cannot reduce the latency of threat detection because it queries already-delivered logs.

Full explanation →
313
MCQeasy

A company wants to automate the response to a specific GuardDuty finding. When GuardDuty detects a finding of type `UnauthorizedAccess:EC2/SSHBruteForce`, they want to automatically block the offending IP address using a network ACL. Which AWS service can they use to orchestrate this response?

A.AWS Lambda
B.AWS Systems Manager Automation
C.AWS Config
D.AWS CloudFormation
AnswerB

Systems Manager Automation is the correct service because it runs SSM runbooks in response to events via Amazon EventBridge. A GuardDuty finding event can invoke a public or custom runbook, which then performs steps such as updating a VPC Network ACL with a deny rule for the offending IP address. This service provides built-in approval gates, rollback controls, and parameterized execution, making it the native orchestration layer for GuardDuty-driven incident response rather than a mere compute or provisioning tool.

Why this answer

AWS Systems Manager Automation is the correct service because it provides a runbook-based automation framework that can be triggered by Amazon EventBridge events from GuardDuty. When GuardDuty generates a finding of type `UnauthorizedAccess:EC2/SSHBruteForce`, an EventBridge rule can invoke an SSM Automation document that modifies the network ACL to block the offending IP address. This orchestration is natively supported by SSM Automation without requiring custom code, making it the ideal choice for automated incident response workflows.

Exam trap

The trap here is that candidates often assume AWS Lambda is the only option for custom automation, but the exam specifically tests knowledge of SSM Automation as a managed orchestration service that can perform remediation actions without writing code, especially when the question uses the word 'orchestrate'.

How to eliminate wrong answers

Option A is wrong because AWS Lambda is a compute service for running custom code, not an orchestration service; while Lambda can be used to modify network ACLs via SDK calls, the question asks for a service to 'orchestrate' the response, and SSM Automation is purpose-built for runbook-based orchestration with built-in error handling and approval steps. Option C is wrong because AWS Config is a configuration auditing and compliance service that evaluates resource configurations against rules; it cannot directly modify network ACLs or execute remediation actions without invoking another service like SSM Automation or Lambda. Option D is wrong because AWS CloudFormation is an infrastructure-as-code service for provisioning and managing AWS resources; it is not designed for real-time event-driven incident response and cannot dynamically modify a network ACL in response to a GuardDuty finding without additional services.

Full explanation →
314
MCQeasy

A company is required to retain CloudTrail logs for 7 years for compliance. Which solution meets this requirement with the LEAST operational overhead?

A.Store logs in CloudWatch Logs with a retention period of 7 years.
B.Configure CloudTrail to automatically delete logs older than 7 years.
C.Use an AWS Lambda function to delete logs older than 7 years.
D.Configure an S3 Lifecycle policy to transition logs to S3 Glacier Deep Archive after 90 days and expire after 7 years.
E.Export logs to AWS Snowball for offline archival.
AnswerD

Lifecycle policies automate retention and minimize costs.

Why this answer

It uses an S3 Lifecycle policy to automatically transition CloudTrail logs to S3 Glacier Deep Archive after 90 days (reducing storage costs) and then expire (delete) the objects after 7 years, meeting the retention requirement with zero ongoing operational effort. This is the least operational overhead solution as it is fully automated within S3, requiring no custom code, manual intervention, or additional services.

Exam trap

The trap here is that candidates may think CloudTrail itself manages log retention (Option B) or that CloudWatch Logs is the simplest option (Option A), but AWS explicitly requires you to manage retention at the destination, and S3 Lifecycle policies are the native, automated, and lowest-overhead solution for long-term archival and deletion.

How to eliminate wrong answers

Option A is wrong because CloudWatch Logs has a maximum retention period of 10 years, but storing 7 years of CloudTrail logs in CloudWatch Logs incurs high ingestion and storage costs compared to S3, and requires manual or automated export for long-term archival, increasing operational overhead. Option B is wrong because CloudTrail does not have a built-in feature to automatically delete logs older than a specified period; log retention and deletion must be managed at the destination (e.g., S3 Lifecycle policies). Option C is wrong because using a Lambda function to delete logs older than 7 years introduces custom code, potential execution failures, and ongoing maintenance, which is higher operational overhead than a native S3 Lifecycle policy.

Option E is wrong because exporting logs to AWS Snowball for offline archival is designed for large-scale data transfer and physical shipping, not for routine 7-year retention, and it adds significant operational overhead and latency.

Full explanation →
315
Multi-Selecthard

A security engineer is designing a VPC with public and private subnets. The application must be able to send outbound traffic to the internet, but inbound traffic from the internet must be blocked except for a single HTTP load balancer. The application also needs to access an S3 bucket in the same AWS region. Which combination of VPC components meets these requirements? (Choose two.)

Select 2 answers
A.S3 Interface Endpoint in the VPC
B.VPC Peering to a shared services VPC
C.NAT Gateway in a public subnet
D.Internet Gateway attached to the VPC
E.S3 Gateway Endpoint in the VPC
AnswersC, E

Allows outbound internet to EC2 instances in private subnets.

Why this answer

A NAT Gateway in a public subnet allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates or API calls) while blocking unsolicited inbound connections. This satisfies the requirement for outbound internet access without exposing private instances directly.

Exam trap

The trap here is that candidates often choose an Internet Gateway (Option D) thinking it can be restricted via security groups or NACLs, but an Internet Gateway itself does not filter traffic—it simply enables bidirectional routing, and blocking inbound traffic requires additional controls like a NAT Gateway or a stateful firewall, which is not the intended design for private subnets.

Full explanation →
316
MCQmedium

A security analyst needs to review all failed SSH login attempts to an EC2 instance. Which combination will provide this information?

A.Use AWS Config to record EC2 instance configuration and check for security group changes.
B.Install the CloudWatch agent on the EC2 instance to collect /var/log/secure and stream to CloudWatch Logs.
C.Enable AWS CloudTrail and search for EC2-related events.
D.Enable VPC Flow Logs for the subnet and query the logs in CloudWatch Logs Insights for rejected traffic on port 22.
AnswerB

The CloudWatch agent (or unified agent) runs inside the EC2 instance and can tail local log files such as /var/log/secure on Amazon Linux/RHEL (or /var/log/auth.log on Ubuntu), streaming them to CloudWatch Logs. The sshd daemon writes entries like 'Failed password for ...' to this file for every failed authentication attempt. Reviewing the collected log group in CloudWatch Logs Insights, for example with a query filtering on 'Failed password', directly reveals the failed SSH login attempts and their source IPs.

Why this answer

The CloudWatch agent installed on the EC2 instance can collect OS-level logs such as /var/log/secure (on Linux), which contains detailed records of SSH authentication attempts, including failed logins. By streaming these logs to CloudWatch Logs, the analyst can query and review all failed SSH login attempts at the application layer. Options A, C, and D capture network-level metadata but do not provide information about authentication failures after a successful TCP connection.

Exam trap

The key pitfall is interpreting 'failed SSH login attempts' as network-level rejections rather than OS-level authentication failures. VPC Flow Logs show only accepted or rejected network traffic, not login outcomes. The correct approach is to collect system authentication logs via the CloudWatch agent.

How to eliminate wrong answers

Option A is wrong because AWS Config records resource configuration changes, not network traffic or login attempts; it cannot capture failed SSH login events. Option B is wrong because /var/log/secure logs successful and failed authentication attempts at the OS level, but the question asks for 'failed SSH login attempts' as seen from the network perspective, and the CloudWatch agent collects OS logs, not network-level rejected packets. Option C is wrong because AWS CloudTrail records API calls made to the AWS management plane, not network traffic or SSH login attempts to the EC2 instance itself.

Full explanation →
317
MCQhard

A security engineer reviews the above IAM policy attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' when connected from the office network (IP range 10.0.0.0/16). What is the most likely cause?

A.The bucket policy overrides the IAM policy
B.The policy does not allow the s3:GetObject action
C.The source IP condition does not match the user's actual IP address
D.The user is not assuming the correct IAM role
AnswerC

The policy condition uses the aws:SourceIp global condition key and requires the request to originate from 10.0.0.0/16, a private RFC 1918 CIDR range. IAM compares this against the actual source IP recorded in the request, so if the IAM user is connecting from outside that range—for example, from a public internet address—the condition fails. When a condition fails, the Allow statement is skipped and the request is implicitly denied.

Why this answer

The IAM policy includes a `Condition` block using `aws:SourceIp` that restricts allowed IP addresses to the range 10.0.0.0/16. If the user's actual office network IP address falls outside this range (e.g., due to NAT or a different subnet), the condition fails, and the `s3:GetObject` action is denied, even though the user has the necessary permissions in the `Action` field.

Exam trap

The trap here is that candidates may overlook the `Condition` block and assume the policy allows the action because `s3:GetObject` is listed, failing to realize that the source IP condition can override the allow even when the action is explicitly permitted.

How to eliminate wrong answers

Option A is wrong because bucket policies and IAM policies are evaluated together; an explicit deny in either will override an allow, but there is no bucket policy mentioned in the scenario, and the IAM policy itself is the likely cause of denial. Option B is wrong because the policy explicitly includes `s3:GetObject` in the `Action` list, so the action is allowed by the policy statement. Option D is wrong because the policy is directly attached to the IAM user, not requiring role assumption; the user is already operating under the attached policy.

Full explanation →
318
MCQeasy

A security engineer wants to capture all DNS queries made by EC2 instances to detect potential data exfiltration. Which AWS service should be used to log the DNS requests?

A.Use Route 53 Resolver DNS Firewall with query logging
B.Use Amazon GuardDuty
C.Enable VPC Flow Logs
D.Enable AWS CloudTrail
AnswerA

DNS Firewall can log DNS queries for VPCs.

Why this answer

Route 53 Resolver DNS Firewall with query logging is the correct choice because it is specifically designed to log all DNS queries made by EC2 instances that use the Route 53 Resolver. This service captures the domain names being queried, the source IP, and the response, enabling detection of DNS-based data exfiltration (e.g., DNS tunneling). It integrates directly with the VPC's DNS resolver, ensuring all outbound DNS traffic from EC2 instances is logged without additional agents.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (which show IP-level metadata) with DNS query logs, not realizing that DNS exfiltration requires the actual domain names being queried, which only DNS-specific logging provides.

How to eliminate wrong answers

Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes DNS logs from Route 53 Resolver DNS Firewall or other sources, but it does not itself capture or log raw DNS queries; it relies on existing logs. Option C is wrong because VPC Flow Logs capture metadata about IP traffic (source/destination IP, ports, protocol) but do not log the actual DNS query names or payloads, making them insufficient for detecting DNS exfiltration. Option D is wrong because AWS CloudTrail logs API calls to AWS services (e.g., Route 53 API calls) but does not capture the DNS queries made by EC2 instances to external domains.

Full explanation →
319
MCQmedium

A security engineer is investigating a potential compromise. An EC2 instance running Amazon Linux 2 is sending outbound traffic to a known malicious IP address. The engineer needs to capture the network traffic for analysis without alerting the attacker. Which solution meets these requirements?

A.Enable VPC Flow Logs on the ENI and stream to Amazon S3 for analysis.
B.Attach a security group to the instance that logs all traffic to CloudWatch Logs.
C.Use VPC Traffic Mirroring to mirror the EC2 instance's ENI traffic to a monitoring appliance in a separate VPC.
D.Enable AWS Network Firewall on the VPC and configure a rule to log all traffic to the malicious IP.
AnswerC

VPC Traffic Mirroring copies the actual packet payloads from the EC2 instance's Elastic Network Interface and forwards them through a mirror session to a monitoring appliance—which can be hosted in a separate VPC via a Gateway Load Balancer or a Network Load Balancer. Because mirroring is out-of-band and does not insert in the data path, the original traffic is unaffected and the attacker is not alerted by any inline inspection or blocking. This provides full packet capture, enabling deep forensic analysis of the attacker's actions, commands, and any exfiltrated data with no impact on the live environment.

Why this answer

VPC Traffic Mirroring captures all network traffic at the packet level from the EC2 instance's Elastic Network Interface (ENI) and forwards it to a monitoring appliance without any inline processing or modification of the traffic. This allows the security engineer to perform deep packet analysis while remaining completely transparent to the attacker, as the mirrored traffic is a copy and does not affect the original flow. Unlike other options, Traffic Mirroring provides full packet capture (including headers and payloads) for forensic analysis, which is essential for investigating a compromise.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (which only provide metadata) with full packet capture, or assume that security groups or Network Firewall can log traffic passively, when in fact they are active security controls that could interfere with the attacker's activities.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture only metadata (source/destination IP, ports, protocol, packet/byte counts) and not the actual packet payloads, so they cannot provide the deep packet analysis needed for investigating a compromise. Option B is wrong because security groups are stateful firewalls that filter traffic at the instance level and do not have a logging capability to CloudWatch Logs; they only allow or deny traffic based on rules, and any logging would require additional agent-based solutions. Option D is wrong because AWS Network Firewall is a managed firewall service that inspects and potentially modifies traffic inline, which could alert the attacker by dropping or altering packets, and it does not provide passive packet capture for analysis.

Full explanation →
320
MCQmedium

Refer to the exhibit. An administrator applies this bucket policy to an S3 bucket. Which of the following statements describes the effect of this policy?

A.The policy denies all PutObject requests that do not specify SSE-KMS.
B.The policy allows uploads without encryption but denies uploads with SSE-KMS.
C.The policy allows unencrypted uploads but denies uploads with SSE-KMS.
D.The policy allows uploads with SSE-S3 but denies uploads with SSE-KMS.
AnswerA

Correct. The policy denies PutObject when the encryption header is not `aws:kms` or is absent, effectively requiring SSE-KMS.

Why this answer

The bucket policy contains two Deny statements: the first denies PutObject when the `x-amz-server-side-encryption` header is not `aws:kms`, and the second denies PutObject when the header is absent (null). Together, they ensure that any upload without SSE-KMS is denied, effectively requiring SSE-KMS for all PutObject requests. Options B, C, and D are incorrect because the policy does not allow any unencrypted uploads or uploads with SSE-S3; it only allows uploads with SSE-KMS.

Exam trap

The trap is that candidates might misread the policy and think the first statement alone denies all non-KMS encryption, but the second statement is needed to also deny requests with no encryption header at all.

Full explanation →
321
MCQhard

A healthcare company runs a HIPAA-compliant application on AWS. The application uses Amazon S3 to store Protected Health Information (PHI). The company has implemented the following controls: (1) All S3 buckets are configured with default encryption using SSE-S3. (2) Bucket policies restrict access to only authorized IAM roles. (3) S3 access logs are enabled and sent to a centralized logging account. (4) MFA Delete is enabled on all buckets. (5) Object lock is not enabled. Recently, an internal auditor discovered that when an authorized user deletes an object, the object is permanently deleted and cannot be recovered. The company's data retention policy requires that deleted PHI be recoverable for at least 30 days after deletion. A review of the IAM policies shows that users have s3:DeleteObject permission. The auditor also notes that the bucket versioning is not enabled. The security team needs to implement a solution that allows authorized users to delete objects but ensures that deleted objects can be recovered within 30 days. Which of the following is the MOST effective course of action?

A.Enable S3 Object Lock in Governance mode with a retention period of 30 days.
B.Enable S3 Versioning on the buckets and ensure that the IAM policies include s3:DeleteObjectVersion where appropriate.
C.Remove the s3:DeleteObject permission from all IAM policies and use S3 Lifecycle policies to expire objects after 30 days.
D.Change the default encryption from SSE-S3 to SSE-C and use a separate key for each object.
AnswerB

S3 Versioning is the correct data-protection mechanism because a regular DELETE on a versioned object only inserts a null-version delete marker while preserving all prior versions, allowing recovery by deleting that marker. Granting the s3:DeleteObjectVersion permission (only where appropriate) enables administrators to permanently purge specific object versions when retention or compliance demands actual deletion, while ordinary deletions remain reversible. This creates a two-tier deletion model where accidental deletes can be untangled and legitimate permanent deletes are still possible, exactly matching the requirement.

Why this answer

Enabling S3 Versioning is the most effective solution because it preserves all object versions, including deleted objects (which become delete markers). With versioning enabled, authorized users can still use s3:DeleteObject to delete the current version, but the previous versions remain recoverable. Since the requirement is to recover deleted PHI within 30 days, versioning combined with a lifecycle policy to permanently delete old versions after 30 days would meet the retention policy without blocking immediate deletion.

Exam trap

The trap here is that candidates may think S3 Object Lock (Option A) is the only way to prevent deletion, but they overlook that versioning allows deletion with recoverability, which directly satisfies the requirement for authorized users to delete objects while retaining the ability to recover them within 30 days.

How to eliminate wrong answers

Option A is wrong because S3 Object Lock in Governance mode prevents any deletion (including overwrites) until the retention period expires, which conflicts with the requirement that authorized users can delete objects immediately. Option C is wrong because removing s3:DeleteObject permission and relying solely on lifecycle policies would prevent users from deleting objects on demand, violating the requirement that authorized users can delete objects. Option D is wrong because changing encryption to SSE-C has no effect on object deletion or recovery; encryption protects data at rest but does not provide versioning or retention capabilities.

Full explanation →
322
Multi-Selectmedium

A security engineer is auditing IAM policies. The engineer wants to identify if any policy grants 'Effect: Allow' with 'Action: *' and 'Resource: *'. Which TWO AWS services can be used to detect such overly permissive policies?

Select 2 answers
A.AWS CloudTrail
B.AWS Trusted Advisor
C.AWS Config
D.IAM Access Analyzer
E.Amazon GuardDuty
AnswersC, D

AWS Config can evaluate custom rules to check for overly permissive policies.

Why this answer

IAM Access Analyzer can analyze policies for broad permissions. AWS Config can evaluate custom rules to check for such policies. Option A (CloudTrail) logs usage, not policy content.

Option B (Trusted Advisor) checks some but not all policies. Option E (GuardDuty) does not analyze IAM policies.

Full explanation →
323
MCQeasy

A security engineer is analyzing the VPC Flow Logs entry in the exhibit. The log shows traffic from an internal IP to an external IP. Which potential security concern should the engineer investigate?

A.The instance is participating in a DDoS attack against the external IP.
B.An EC2 instance is attempting to connect to an external host on port 3389 (RDP).
C.An external host is scanning the internal network on port 443.
D.The security group allows inbound RDP from 0.0.0.0/0.
AnswerB

Outbound RDP from an internal EC2 instance to an external host on port 3389 is inherently suspicious because RDP is a remote administration protocol and is not a normal outbound service. This direction of traffic can indicate a compromised instance serving as a pivot, data exfiltration, or an attacker maintaining persistent control. The flow log shows source 10.0.1.5 (private) to destination 203.0.113.50 on port 3389, so the correct interpretation is that the instance is attempting an outbound RDP connection.

Why this answer

The VPC Flow Logs entry shows outbound traffic from an internal IP to an external IP on destination port 3389, which is the default port for Remote Desktop Protocol (RDP). RDP outbound from an EC2 instance to an external host is a security concern because it could indicate an attacker using the instance as a pivot point to connect to an external command-and-control server or to exfiltrate data via an RDP tunnel. The log direction (src internal, dst external) and port 3389 specifically point to an outbound RDP attempt, not inbound scanning or DDoS.

Exam trap

The trap here is that candidates focus on the port number (3389) and assume it is about inbound RDP from the internet, but the flow direction (src internal, dst external) indicates outbound traffic, which is a different security concern related to egress filtering and potential command-and-control activity.

How to eliminate wrong answers

Option A is wrong because a single outbound RDP connection to an external IP does not indicate participation in a DDoS attack; DDoS attacks typically involve high-volume traffic (e.g., SYN floods, UDP floods) to many targets, not a single TCP connection on port 3389. Option C is wrong because the log shows traffic from an internal IP to an external IP (src internal, dst external), not an external host scanning the internal network; scanning would have the external IP as the source. Option D is wrong because the VPC Flow Logs entry does not contain any information about security group rules; it only shows the traffic flow, and the concern is the outbound RDP attempt, not inbound rules.

Full explanation →
324
MCQeasy

A security engineer is responsible for monitoring AWS account activity. The engineer needs to receive real-time notifications when specific API calls are made, such as 'DeleteTrail' or 'UpdateTrail'. The engineer wants to use AWS services to achieve this with minimal latency. Which combination of services should the engineer use?

A.CloudTrail -> Amazon EventBridge -> Amazon SNS
B.CloudTrail -> Amazon S3 -> S3 event notification -> AWS Lambda -> Amazon SNS
C.CloudTrail -> CloudWatch Logs -> CloudWatch Logs subscription filter -> AWS Lambda -> Amazon SNS
D.CloudTrail -> CloudWatch Logs -> CloudWatch metric filter -> CloudWatch alarm -> Amazon SNS
AnswerD

This architecture provides near real-time alerting based on API calls.

Why this answer

The correct solution is to send CloudTrail logs to CloudWatch Logs, create a metric filter to match the specific API calls (e.g., 'DeleteTrail', 'UpdateTrail'), and set up a CloudWatch alarm on that metric that publishes to an SNS topic. This provides near-real-time alerts. Option D is correct.

Option A is incorrect because while CloudTrail can send events to EventBridge, the event delivery is not as immediate as CloudWatch Logs metric filter approach for this use case. Option B is incorrect because S3 event notifications are for object-level events and not suitable for monitoring CloudTrail API calls. Option C is incorrect because CloudWatch Logs subscription filters are for streaming logs to other destinations, not for directly triggering alarms.

Full explanation →
325
MCQmedium

An organization is using IAM roles for EC2 instances. The security team needs to ensure that each EC2 instance can only assume a specific role based on tags. Which feature should be used?

A.Service Control Policy (SCP)
B.IAM policy with 'aws:SourceIp' condition
C.IAM permissions boundary
D.Role trust policy with 'aws:ResourceTag' condition
AnswerD

The trust policy can use tags to restrict which EC2 instances can assume the role.

Why this answer

The role trust policy can use the 'aws:ResourceTag' condition key to restrict which EC2 instances can assume the role based on the instance's tags. This ensures that only instances with specific tags (e.g., 'Environment=Production') are allowed to assume the IAM role, meeting the security team's requirement for tag-based role assumption.

Exam trap

The trap here is that candidates often confuse IAM permissions boundaries (which limit permissions) with trust policies (which control who can assume a role), leading them to select Option C instead of the correct trust policy condition.

How to eliminate wrong answers

Option A is wrong because Service Control Policies (SCPs) are used to set permission boundaries across accounts in an AWS Organization, not to control role assumption based on EC2 instance tags. Option B is wrong because 'aws:SourceIp' condition restricts access based on the source IP address, not on EC2 instance tags, and is irrelevant for instance-based role assumption. Option C is wrong because IAM permissions boundaries define the maximum permissions a role or user can have, but they do not control which EC2 instances can assume a role based on tags.

Full explanation →
326
MCQmedium

A company uses AWS Organizations and wants to enforce that all S3 buckets created in any account within the organization have default encryption enabled. Which policy should be used?

A.Use a bucket policy on each bucket to enforce encryption
B.Use a service control policy (SCP) to deny creation of buckets without default encryption
C.Use an IAM policy to require encryption on all bucket creation actions
D.Use AWS Config rules to automatically enable encryption on new buckets
AnswerB

SCPs can enforce rules across all accounts in the organization.

Why this answer

(SCP) is correct because a service control policy can be applied to all accounts in an AWS Organization to deny the creation of S3 buckets without default encryption, providing a preventive control. Option A is incorrect because bucket policies are applied per bucket and are not preventive during creation. Option C is incorrect because IAM policies are account-specific and do not cover all accounts in the organization.

Option D is incorrect because AWS Config rules are detective, not preventive; they can trigger remediation but do not prevent creation.

Full explanation →
327
Multi-Selectmedium

A security engineer is designing a VPC with public and private subnets. The application servers in the private subnets need to access the internet for software updates, but must not be directly reachable from the internet. Which TWO actions satisfy these requirements?

Select 2 answers
A.Configure the private subnet's security group to allow inbound traffic from 0.0.0.0/0.
B.Add a route in the private subnet's route table pointing to the NAT gateway.
C.Attach an internet gateway to the private subnet's route table.
D.Create a VPC gateway endpoint for Amazon S3.
E.Deploy a NAT gateway in a public subnet.
AnswersB, E

Correct: This routes outbound internet traffic through the NAT gateway.

Why this answer

A NAT gateway, when deployed in a public subnet with an associated Elastic IP and a route to an internet gateway, allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing any unsolicited inbound connections from the internet. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT gateway's private IP address to forward outbound traffic through it.

Exam trap

The trap here is that candidates often confuse a NAT gateway with an internet gateway, mistakenly thinking that adding an internet gateway to a private subnet's route table provides outbound-only access, when in fact it enables bidirectional internet connectivity and requires public IPs on the instances.

Full explanation →
328
MCQeasy

A company wants to audit all changes to security group rules in their AWS account. Which AWS service should be used to record these changes?

A.Amazon CloudWatch Logs.
B.AWS CloudTrail.
C.VPC Flow Logs.
D.AWS Config.
AnswerB

AWS CloudTrail is the service designed to record AWS API activity, and it captures every security group change as an API event such as AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupEgress, CreateSecurityGroup, or DeleteSecurityGroup. Each event includes the identity of the caller, the source IP address, the request parameters, and the response elements, giving a complete audit trail of who changed what and when. This makes CloudTrail the appropriate service for auditing all changes to security group rules.

Why this answer

AWS CloudTrail is the correct service because it records API calls made to the AWS environment, including changes to security group rules via the EC2 AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress, AuthorizeSecurityGroupEgress, and RevokeSecurityGroupEgress API actions. These events are captured as management events in CloudTrail, providing a complete audit trail of who made the change, when, from which IP address, and the exact parameters of the rule modification.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks resource configuration state) with CloudTrail (which tracks API activity), leading them to select AWS Config because they think 'audit changes' means monitoring the current state of rules, but the question specifically asks for recording the changes themselves, which requires API-level logging.

How to eliminate wrong answers

Option A is wrong because Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log files from AWS resources, but it does not natively capture API-level changes to security group rules; it would require custom integration or agent-based logging. Option C is wrong because VPC Flow Logs capture metadata about network traffic (IP addresses, ports, protocols) flowing through ENIs, not the configuration changes to security group rules themselves. Option D is wrong because AWS Config evaluates and records resource configuration changes over time, but it is not the primary service for auditing API calls; CloudTrail is the service that records the API actions that trigger those configuration changes, while AWS Config focuses on the resulting state.

Full explanation →
329
Multi-Selecthard

Which THREE AWS services can be used to centrally manage security across multiple accounts? (Select THREE.)

Select 3 answers
A.AWS Config
B.AWS Shield
C.AWS CloudTrail
D.Amazon GuardDuty
E.AWS Organizations
AnswersA, C, E

Config can aggregate rules and compliance across accounts.

Why this answer

AWS Config is correct because it provides a centralized view of resource configurations and compliance across multiple accounts when integrated with AWS Organizations. By enabling Config in the management account and using aggregation authorizations, you can aggregate configuration and compliance data from all member accounts into a single administrator account, enabling centralized security governance.

Exam trap

The trap here is that candidates confuse services that aggregate findings (like GuardDuty with Organizations) with services that centrally manage security policies and configurations, leading them to select GuardDuty instead of recognizing that only AWS Config, AWS CloudTrail (for centralized logging), and AWS Organizations (for policy-based governance) provide true centralized management.

Full explanation →
330
MCQmedium

A company wants to automatically detect and notify about any S3 buckets that have public read access. Which combination of services should be used?

A.AWS CloudTrail and AWS Lambda
B.AWS Config and Amazon EventBridge
C.AWS IAM Access Analyzer and Amazon CloudWatch
D.AWS Trusted Advisor and Amazon SES
AnswerB

Config evaluates and sends events to EventBridge, which can trigger SNS.

Why this answer

AWS Config can evaluate S3 bucket public access using managed rules, and Amazon EventBridge can trigger notifications via SNS.

Full explanation →
331
MCQhard

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all IAM users in member accounts must have a password policy that requires a minimum length of 14 characters. How can this be achieved centrally?

A.Use a service control policy (SCP) to enforce the password policy across all accounts.
B.Use IAM permission boundaries to restrict password policy changes to specific Regions.
C.Use AWS Config rules to automatically remediate non-compliant password policies.
D.Use an SCP that denies the UpdateAccountPasswordPolicy action unless the policy has MinimumPasswordLength >= 14.
AnswerD

SCPs can deny API calls that don't meet conditions.

Why this answer

A service control policy (SCP) can deny the UpdateAccountPasswordPolicy action if the password policy does not have MinimumPasswordLength >= 14. Option A is incorrect because SCPs cannot set password policies; they only allow or deny actions. Option B is incorrect because IAM permission boundaries do not apply to password policy changes, and IAM is a global service.

Option C is incorrect because AWS Config rules can detect non-compliance but cannot enforce the policy; remediation requires additional steps and is not a centralized enforcement method.

Full explanation →
332
MCQmedium

A company uses AWS Lambda functions to process data from an S3 bucket. The security team wants to detect any unauthorized attempts to invoke the Lambda function from outside the company's VPC. The Lambda function is configured to be VPC-enabled and is attached to a VPC with a security group. The team has enabled CloudTrail and VPC Flow Logs. However, they are not seeing any logs for the Lambda invocations in CloudTrail. The team has checked that CloudTrail is logging management events and that the Lambda function is being invoked. What is the most likely reason for the missing CloudTrail logs?

A.CloudTrail is not logging Lambda Invoke API calls because they are data events, not management events.
B.The Lambda function is not configured to send logs to CloudTrail.
C.The CloudTrail trail is not configured to log data events for Lambda.
D.VPC Flow Logs are not enabled for the Lambda function's VPC.
AnswerA

Invoke calls are data events and require enabling data events in CloudTrail.

Why this answer

CloudTrail management events do not include Lambda Invoke API calls because these are data events, not management events. To log Lambda invocations, data events must be explicitly enabled in the CloudTrail trail configuration. Option B is incorrect because Lambda functions do not need to be configured to send logs to CloudTrail; CloudTrail automatically captures API calls if configured.

Option C is incorrect as the issue is not about configuring data events; the question states data events are not enabled. Option D is incorrect because VPC Flow Logs capture network traffic, not Lambda invocations.

Full explanation →
333
Multi-Selectmedium

A security engineer is investigating a potential security incident in an AWS account. The engineer needs to determine which user or role performed a specific API call that created a new security group. Which THREE AWS tools can the engineer use to find this information? (Choose THREE.)

Select 3 answers
A.AWS CloudTrail event history
B.Amazon CloudWatch Logs
C.VPC Flow Logs
D.AWS CloudTrail
E.AWS Config
AnswersA, D, E

Event history provides a searchable view of the last 90 days of API calls.

Why this answer

D, and E are correct. CloudTrail logs all API calls, including who made the call. CloudTrail event history provides a view of the last 90 days.

AWS Config records configuration changes, including security group creation. Option B is wrong because CloudWatch Logs does not capture API calls unless specifically configured. Option C is wrong because VPC Flow Logs capture network traffic, not API calls.

Full explanation →
334
MCQmedium

A security engineer is troubleshooting why CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured with the correct bucket name. However, no log files appear. What is the most likely cause?

A.The S3 bucket has an S3 Object Lock configuration that prevents writes.
B.The S3 bucket is in a different AWS Region from the trail.
C.CloudTrail is not enabled in the AWS Region where the S3 bucket resides.
D.The S3 bucket uses AWS KMS server-side encryption (SSE-KMS) and the KMS key policy does not grant CloudTrail permission to use the key.
AnswerD

When a destination bucket uses SSE-KMS, CloudTrail must have permission to call kms:GenerateDataKey for encrypting each log file and kms:Decrypt for delivering or reading those files. If the KMS key policy does not explicitly grant CloudTrail these actions, PutObject requests to the bucket will fail even if the bucket policy is correct. CloudTrail’s role also needs the appropriate KMS permissions in the trail’s advanced settings, but the key policy is the critical constraint here.

Why this answer

When CloudTrail is configured to deliver logs to an S3 bucket that uses SSE-KMS, CloudTrail must have explicit permission to use the KMS key for encrypting the log files. Even if the bucket policy allows CloudTrail to write objects, the KMS key policy must grant the `kms:GenerateDataKey` and `kms:Decrypt` actions to the CloudTrail service principal. Without these permissions, CloudTrail cannot encrypt the logs, and delivery fails silently—no log files appear.

Exam trap

The trap here is that candidates often focus only on the S3 bucket policy and overlook the separate KMS key policy requirement, assuming that SSE-KMS encryption is transparent to CloudTrail.

How to eliminate wrong answers

Option A is wrong because S3 Object Lock, when configured, prevents object deletion or overwrite, but it does not prevent initial writes; CloudTrail can still create new log objects. Option B is wrong because CloudTrail can deliver logs to an S3 bucket in a different AWS Region; cross-region delivery is supported and not a cause of failure. Option C is wrong because CloudTrail is enabled in the region where the trail is created, not necessarily where the S3 bucket resides; the trail's region determines logging, not the bucket's region.

Full explanation →
335
MCQeasy

A security engineer is configuring an AWS environment to detect and respond to potential security threats. Which AWS service can be used to automate the remediation of unwanted access to Amazon S3 buckets by invoking AWS Lambda functions?

A.AWS Config
B.Amazon GuardDuty
C.Amazon Inspector
D.AWS WAF
AnswerB

Amazon GuardDuty is a threat detection service that continuously analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs using machine learning and integrated threat intelligence. It specifically detects suspicious S3 access patterns, such as unusual geographical locations, high-volume downloads, or bucket enumeration, and raises findings that can be sent to Amazon EventBridge. This enables automated remediation, for example a Lambda function that revokes IAM policies or applies a bucket policy, making it the correct choice for detecting and automating response to access threats.

Why this answer

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads. It can integrate with AWS Lambda functions via CloudWatch Events to automate remediation actions, such as blocking unwanted access to S3 buckets by updating bucket policies or removing public access. This makes GuardDuty the correct choice for detecting and automatically responding to security threats against S3 resources.

Exam trap

The trap here is that candidates often confuse AWS Config's ability to auto-remediate noncompliant resources (using AWS Config rules and Lambda) with GuardDuty's threat-specific detection and response, but AWS Config does not detect security threats like unauthorized access—it only enforces configuration rules.

How to eliminate wrong answers

Option A is wrong because AWS Config is a configuration auditing and compliance service that evaluates resource configurations against rules, but it does not natively detect security threats or invoke Lambda functions for threat remediation; it can trigger Lambda for configuration drift, not for threat response. Option C is wrong because Amazon Inspector is a vulnerability assessment service that scans EC2 instances and container images for software vulnerabilities and network exposure, not for detecting or remediating unwanted access to S3 buckets. Option D is wrong because AWS WAF is a web application firewall that protects web applications from common exploits like SQL injection and cross-site scripting, and it does not monitor or remediate S3 bucket access patterns.

Full explanation →
336
Multi-Selecteasy

A developer wants to allow an IAM role to be assumed by an EC2 instance that is part of an Auto Scaling group. Which TWO AWS services or features are required? (Choose TWO.)

Select 2 answers
A.AWS Config
B.Instance profile
C.IAM role
D.AWS CloudFormation
E.AWS Single Sign-On (SSO)
AnswersB, C

The instance profile is the container for the role that can be attached to EC2 instances.

Why this answer

An instance profile is required to attach an IAM role to an EC2 instance. When an EC2 instance is launched with an instance profile, the AWS credentials provider on the instance can retrieve temporary security credentials from the IAM role via the instance metadata service (IMDS). This allows the instance to assume the role and perform authorized API actions without embedding long-term credentials.

Exam trap

The trap here is that candidates often confuse IAM roles with instance profiles, thinking a role can be directly attached to an EC2 instance, but the instance profile is the required intermediary container that enables the role to be assumed by the instance.

Full explanation →
337
MCQhard

A company's security team needs to implement a solution to detect and alert on the creation of IAM users or roles with administrative privileges. The solution must be able to analyze historical account activity and provide real-time alerts. Which combination of AWS services should be used?

A.AWS CloudTrail and Amazon CloudWatch Logs with metric filters and alarms
B.Amazon GuardDuty and AWS Lambda
C.AWS Trusted Advisor and Amazon SES
D.AWS Config with managed rules and Amazon SNS
AnswerA

AWS CloudTrail records IAM API calls for user/role creation and policy attachment. CloudWatch Logs metric filters on these events can trigger CloudWatch Alarms for real-time alerts. CloudTrail also retains historical logs for analysis. This combination meets the requirements.

Why this answer

AWS CloudTrail logs IAM CreateUser, CreateRole, and AttachRolePolicy events. Amazon CloudWatch Logs can use metric filters to capture these events and trigger CloudWatch Alarms for real-time alerts. CloudTrail also stores historical logs for analysis.

Option A is the correct combination. Option B (GuardDuty and Lambda) is focused on threat detection, not specific IAM administrative privilege creation events. Option C (Trusted Advisor and SES) provides best-practice recommendations and email notifications, not real-time API monitoring.

Option D (AWS Config and SNS) evaluates resource configuration compliance but does not monitor API calls in real time.

Full explanation →
338
MCQeasy

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all data is encrypted in transit between the company's on-premises data center and AWS. Which solution should be used?

A.Use an AWS Site-to-Site VPN with IPsec to encrypt traffic
B.Use AWS CloudHSM to encrypt the data in transit
C.Enable SSE-S3 on the S3 bucket
D.Use AWS KMS to encrypt the data before transmission
AnswerA

VPN provides encrypted transit.

Why this answer

An AWS Site-to-Site VPN with IPsec is the correct solution because it creates an encrypted tunnel between the on-premises data center and AWS, ensuring all data in transit is protected. IPsec operates at the network layer (Layer 3) and encrypts the entire IP packet, providing confidentiality and integrity for data moving over the public internet. This directly addresses the requirement to encrypt data in transit between the two environments.

Exam trap

The trap here is that candidates often confuse encryption at rest (SSE-S3, KMS) with encryption in transit, and assume that encrypting data before sending it (e.g., with KMS) automatically secures the transmission channel, when in fact a transport-layer encryption mechanism like IPsec or TLS is required to protect data during transit.

How to eliminate wrong answers

Option B is wrong because AWS CloudHSM is a hardware security module used for key storage and cryptographic operations, not for encrypting data in transit; it does not provide network-level encryption between on-premises and AWS. Option C is wrong because SSE-S3 (Server-Side Encryption with S3-Managed Keys) encrypts data at rest in S3, not data in transit; it has no effect on traffic between the on-premises data center and AWS. Option D is wrong because AWS KMS is a key management service that can be used to encrypt data before transmission, but it does not provide a secure tunnel or protocol-level encryption for the data in transit; the data would still be sent over the internet in an unencrypted form unless a transport encryption mechanism like TLS or IPsec is also applied.

Full explanation →
339
MCQhard

A Security Engineer is designing a network architecture for a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier, and the database tier only from the application tier. All tiers are in the same VPC. Which configuration meets these requirements with minimal administrative overhead?

A.Use network ACLs with inbound rules that reference the prefix list of the previous tier's subnets.
B.Use network ACLs with inbound rules that allow traffic from the previous tier's subnet CIDR.
C.Use security groups with inbound rules that allow traffic from the previous tier's public IP addresses.
D.Use security groups with inbound rules that reference the security group of the previous tier.
AnswerD

Referencing the previous tier's security group as the source in an inbound rule is the correct approach because security groups are stateful and allow logical references to other security groups, not just IP addresses. When you assign an instance to the source security group, it automatically becomes allowed to reach the target tier, even if its IP address changes or new instances are added. This eliminates the need to manage CIDR blocks or public IPs and keeps security policies tightly aligned with architectural tiers. It is the AWS-recommended pattern for multi-tier security group design.

Why this answer

Security groups are stateful and can reference other security groups as a source in inbound rules, allowing traffic from any instance associated with the referenced security group regardless of IP address changes. This creates a logical dependency chain (web SG → app SG → db SG) that enforces the required tier-to-tier access with zero maintenance when instances scale or subnets change. Option D meets the requirement with minimal administrative overhead because security group references automatically adapt to dynamic environments.

Exam trap

The trap here is that candidates confuse network ACLs with security groups, assuming stateless ACLs can use logical references like security group IDs, or they overlook the administrative overhead of managing CIDR-based rules in dynamic architectures.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and cannot reference prefix lists of subnets as a source in inbound rules; they only support CIDR blocks, IP ranges, or protocol/port numbers. Option B is wrong because network ACLs require explicit allow and return traffic rules (stateless), and using subnet CIDRs creates administrative overhead when subnets change or scale, plus they cannot dynamically follow instances that move between subnets. Option C is wrong because referencing public IP addresses is fragile (IPs can change with scaling or NAT), violates the principle of using private addressing within a VPC, and adds administrative burden to track and update IPs.

Full explanation →
340
MCQmedium

A security engineer is troubleshooting an issue where an IAM role used by an EC2 instance cannot access an S3 bucket, even though the role has an attached policy that grants s3:GetObject on the bucket. The bucket policy does not explicitly deny access. What is the most likely cause?

A.A service control policy (SCP) is denying access
B.The bucket policy does not grant access to the IAM role
C.The IAM policy is attached to the user instead of the role
D.The bucket has an explicit deny in its policy
AnswerB

When using an IAM role, the bucket policy must explicitly allow the role, otherwise the implicit denial applies.

Why this answer

The bucket policy does not grant access to the IAM role. For an IAM role used by an EC2 instance to access an S3 bucket, both the IAM policy attached to the role and the bucket policy must allow the action. Even though the IAM policy grants s3:GetObject, the bucket policy must also explicitly grant access to the role principal.

Since the bucket policy does not explicitly deny access (option D is false), the lack of an explicit allow in the bucket policy is the most likely cause. Options A and C are incorrect: SCPs would deny at the organization level, and the IAM policy is attached to the role, not the user.

Full explanation →
341
Multi-Selecteasy

A company needs to protect data at rest in Amazon S3. Which THREE server-side encryption mechanisms can be used to encrypt objects stored in S3?

Select 3 answers
A.Server-Side Encryption with S3-Managed Keys (SSE-S3)
B.Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)
C.Client-Side Encryption
D.Server-Side Encryption with IAM-Managed Keys (SSE-IAM)
E.Server-Side Encryption with Customer-Provided Keys (SSE-C)
AnswersA, B, E

SSE-S3 is a valid server-side encryption option where Amazon S3 manages the encryption keys.

Why this answer

Server-Side Encryption with S3-Managed Keys (SSE-S3), Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS), and Server-Side Encryption with Customer-Provided Keys (SSE-C) are the three server-side encryption mechanisms for Amazon S3. Client-side encryption (option C) encrypts data before upload and is also a valid method to protect data at rest, but it is not a server-side mechanism. Option D (SSE-IAM) is not a real feature.

Thus, the correct choices are A, B, and E.

Full explanation →
342
MCQmedium

A security engineer needs to detect and alert on suspicious API calls made from a compromised EC2 instance. The instance is associated with an IAM role that has permissions to call various AWS APIs. Which AWS service should the engineer use to monitor API calls and trigger alerts?

A.Amazon GuardDuty
B.AWS CloudTrail combined with Amazon CloudWatch Events
C.AWS Config
D.VPC Flow Logs
AnswerB

AWS CloudTrail records every API call made to AWS services, capturing details such as the identity, time, source IP, and request parameters. By sending these event logs to Amazon CloudWatch Events (or Amazon EventBridge), you can create custom rules to match specific API activity, such as unusual calls or attempts from unexpected regions, and trigger alerts via SNS or AWS Lambda. This combination gives you direct, real-time, and customizable detection and alerting on the API calls themselves, making it the correct choice.

Why this answer

AWS CloudTrail records all API calls made by or on behalf of the EC2 instance's IAM role. By sending these logs to Amazon CloudWatch Events (now Amazon EventBridge), you can create rules that match specific API actions (e.g., 'ec2:TerminateInstances') and trigger alerts via SNS, Lambda, or other targets. This combination provides real-time monitoring and alerting for suspicious API activity from a compromised instance.

Exam trap

The trap here is that candidates confuse GuardDuty's threat detection capabilities with the need for custom alerting on specific API calls, overlooking that CloudTrail combined with CloudWatch Events (EventBridge) is the correct service pair for granular, user-defined monitoring and alerting.

How to eliminate wrong answers

Option A is wrong because Amazon GuardDuty is a threat detection service that analyzes VPC Flow Logs, DNS logs, and CloudTrail events to identify malicious behavior, but it does not natively trigger custom alerts for specific API calls; it generates its own findings. Option C is wrong because AWS Config is a resource inventory and compliance service that evaluates configuration changes against rules, not a real-time API monitoring and alerting service. Option D is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) but do not log API calls or IAM role activity, so they cannot detect suspicious API calls.

Full explanation →
343
Multi-Selecteasy

A security engineer needs to ensure that all API calls in an AWS account are logged for auditing purposes. Which TWO services should the engineer enable? (Select TWO.)

Select 2 answers
A.VPC Flow Logs
B.AWS CloudTrail
C.Amazon CloudWatch Logs
D.Amazon GuardDuty
E.AWS Config
AnswersB, E

CloudTrail logs API calls for governance and auditing.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made in an AWS account, including the identity of the caller, the time of the call, the source IP address, and the request parameters. This provides a complete audit trail of all management and data plane operations, which is essential for security auditing and compliance.

Exam trap

The trap here is that candidates often confuse VPC Flow Logs (network traffic) with API call logging, or think CloudWatch Logs is the primary logging service, when in fact CloudTrail is the dedicated service for API auditing.

Full explanation →
344
MCQmedium

A company uses AWS Organizations with multiple accounts and wants to ensure that all newly created S3 buckets have encryption enabled. The Security team needs a solution that automatically remediates non-compliant buckets without manual intervention. What should they do?

A.Apply a service control policy (SCP) that denies the s3:PutBucketPublicAccessBlock and s3:PutBucketEncryption actions unless the bucket has encryption enabled.
B.Use an S3 bucket policy that denies PutObject unless the request includes the x-amz-server-side-encryption header.
C.Enable AWS Config with the s3-bucket-server-side-encryption-enabled rule and set up automatic remediation using Systems Manager Automation.
D.Create an IAM role with permissions to enforce encryption and attach it to all accounts in the organization.
AnswerC

AWS Config's managed rule s3-bucket-server-side-encryption-enabled continuously evaluates each bucket and flags any bucket whose default encryption setting is disabled. When non-compliance is detected, the rule can trigger an SSM Automation remediation—typically the AWS-EnableS3BucketEncryption document—which automatically applies the appropriate SSE-S3 or SSE-KMS default encryption to the bucket. This pairing of continuous detection and automated remediation provides an enforceable, organization-wide corrective control that directly satisfies the encryption requirement.

Why this answer

AWS Config can continuously evaluate S3 buckets against the s3-bucket-server-side-encryption-enabled rule and automatically remediate non-compliant buckets using Systems Manager Automation, requiring no manual intervention. Option A is incorrect because a service control policy (SCP) cannot enforce encryption on bucket creation; the described SCP is circular and unenforceable since it denies s3:PutBucketEncryption unless encryption is already enabled, which is impossible to satisfy at creation time.

Exam trap

Candidates often think SCPs can enforce encryption on resource creation, but SCPs only control API permissions, not resource configuration. The correct approach is reactive remediation via AWS Config and automation, not proactive denial through SCPs.

How to eliminate wrong answers

Option B is wrong because an S3 bucket policy that denies PutObject unless the x-amz-server-side-encryption header is present only enforces encryption on objects uploaded to existing buckets, not on the bucket creation itself, and does not prevent creation of unencrypted buckets. Option C is wrong because AWS Config with the s3-bucket-server-side-encryption-enabled rule can detect non-compliant buckets, but automatic remediation using Systems Manager Automation requires manual setup and may not prevent creation in real time; it is reactive rather than proactive. Option D is wrong because creating an IAM role with permissions to enforce encryption and attaching it to all accounts does not automatically enforce encryption on new buckets; it only provides the capability, and users could still create buckets without encryption if they have other permissions.

Full explanation →
345
MCQhard

A company uses Amazon GuardDuty to monitor for threats. The security team receives a high-severity finding: 'UnauthorizedAccess:EC2/SSHBruteForce'. The finding indicates a single EC2 instance with a public IP is receiving SSH connection attempts from multiple external IPs. The instance is part of an Auto Scaling group and is fronted by an Application Load Balancer (ALB). The security team wants to block the attacking IPs without disrupting legitimate traffic. What is the MOST effective approach?

A.Stop the EC2 instance and launch a new one in a different subnet.
B.Modify the security group of the EC2 instance to deny inbound SSH from the attacking IPs.
C.Create a network ACL rule on the subnet to deny inbound traffic from the attacking IPs.
D.Configure AWS WAF on the ALB to block the attacking IPs using an IP set rule.
AnswerB

Modifying the security group to deny inbound SSH from the attacking IPs directly blocks the SSH brute force attempts at the instance level. Since the instance uses a security group that can be applied to all instances in the Auto Scaling group, this approach is effective and persistent.

Why this answer

Modifying the security group of the EC2 instance to deny inbound SSH from the attacking IPs directly blocks the SSH brute force attempts at the instance level. Since the instance is part of an Auto Scaling group, security group modifications will apply to all instances launched with that security group, and updates are immediate. Option D (AWS WAF on ALB) is ineffective because WAF only inspects HTTP/HTTPS traffic at Layer 7, while SSH traffic operates at Layer 4 and does not pass through the ALB; the ALB only handles HTTP/HTTPS, not SSH.

The attackers are targeting the instance's public IP directly over SSH, not through the ALB. Therefore, WAF cannot block SSH traffic. Option A (stop instance) is disruptive and unnecessary.

Option C (network ACL) would block traffic at the subnet level but would affect all instances in the subnet and is less granular than a security group.

Exam trap

The trap is that candidates assume AWS WAF can block any type of traffic when attached to an ALB, but WAF only inspects HTTP/HTTPS requests at Layer 7, not SSH traffic at Layer 4. The correct approach is to use a security group to block SSH at the instance level.

How to eliminate wrong answers

Option A is wrong because stopping the EC2 instance and launching a new one in a different subnet does not block the attacking IPs; it only changes the instance's IP address, and the attackers can still target the new instance. Option B is wrong because modifying the security group to deny inbound SSH from the attacking IPs would block SSH from those IPs but would also disrupt legitimate SSH traffic from those IPs if any existed, and it does not address the fact that the instance is behind an ALB where SSH traffic typically bypasses the ALB; moreover, security group rules are stateful and cannot block traffic at the application layer. Option C is wrong because creating a network ACL rule to deny inbound traffic from the attacking IPs would block all traffic from those IPs at the subnet level, including legitimate traffic (e.g., HTTP/HTTPS via the ALB), and network ACLs are stateless, requiring separate inbound and outbound rules, which complicates management and can disrupt legitimate traffic.

Full explanation →
346
Multi-Selecteasy

Which TWO AWS services can be used to monitor network traffic for malicious activity? (Select TWO.)

Select 2 answers
A.AWS Network Firewall
B.Amazon GuardDuty
C.AWS Shield
D.AWS WAF
E.Amazon Inspector
AnswersA, B

Network Firewall provides stateful inspection and threat detection.

Why this answer

AWS Network Firewall is a managed service that provides network layer filtering and intrusion prevention. It can inspect traffic at layers 3–7 using stateful rules, domain lists, and Suricata-compatible IPS signatures to detect and block malicious activity such as exploits or malware command-and-control traffic. Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence (e.g., known malicious IPs, domain reputation) to monitor VPC Flow Logs, DNS logs, and CloudTrail events for suspicious network behavior like port scanning or crypto-mining traffic.

Exam trap

The trap here is that candidates confuse AWS Shield (DDoS protection) or AWS WAF (web application firewall) with network traffic monitoring, but neither performs deep packet inspection or threat detection for general malicious network activity beyond their specific scopes.

Full explanation →
347
MCQmedium

A company has an S3 bucket that contains sensitive data. The security team wants to ensure that all objects uploaded to the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). What should the security team do to enforce this requirement?

A.Use an S3 bucket policy that requires the x-amz-server-side-encryption-aws-kms-key-id header to match a specific KMS key.
B.Use an S3 bucket policy with a condition that requires the x-amz-server-side-encryption header to be present.
C.Configure the bucket's default encryption to use SSE-KMS.
D.Use an S3 bucket policy with a condition that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.
AnswerD

This policy denies uploads that do not use SSE-KMS, effectively enforcing the requirement.

Why this answer

An S3 bucket policy with a condition that denies PutObject requests unless the x-amz-server-side-encryption header is set to 'aws:kms' ensures that only objects encrypted with SSE-KMS can be uploaded. Option A is incorrect because requiring a specific KMS key ID is not necessary; the policy should enforce the use of SSE-KMS, not a specific key. Option B is incorrect because requiring the header to be present does not enforce SSE-KMS; it could be 'AES256' for SSE-S3.

Option C is incorrect because default encryption only encrypts objects that lack encryption headers; it does not prevent uploads that specify SSE-S3 or no encryption.

Full explanation →
348
MCQhard

Refer to the exhibit. A security engineer wants to monitor a Lambda function for errors and create a CloudWatch alarm when errors exceed a threshold. The engineer notices the log group exists but has no metric filters. What should the engineer do to set up the alarm?

A.Enable CloudWatch Contributor Insights for the Lambda function to automatically detect errors.
B.Create a metric filter on the log group to count occurrences of 'ERROR' in log streams, then create an alarm based on that metric.
C.Configure the Lambda function to publish custom metrics for errors instead of relying on logs.
D.Use CloudWatch Logs Insights to query logs for errors and create an alarm directly from the query results.
AnswerB

This is the standard approach: define a metric filter to extract error counts from logs, then create an alarm.

Why this answer

CloudWatch Logs metric filters allow you to extract and count specific patterns (like 'ERROR') from log streams, and then create a CloudWatch alarm based on that metric. This directly addresses the requirement to monitor the Lambda function for errors without needing to modify the function code or rely on external tools.

Exam trap

The trap here is that candidates may confuse CloudWatch Logs Insights (a query tool) with metric filters (a real-time monitoring mechanism), or assume that Contributor Insights can generate alarms, when in fact only metric filters can directly feed into CloudWatch alarms.

How to eliminate wrong answers

Option A is wrong because CloudWatch Contributor Insights analyzes log data to identify top contributors (e.g., IP addresses), not to count error occurrences or trigger alarms based on error thresholds. Option C is wrong because publishing custom metrics from the Lambda function would require code changes and does not leverage the existing log group, which the engineer wants to use. Option D is wrong because CloudWatch Logs Insights is a query tool for ad-hoc analysis and cannot directly create alarms; alarms must be based on metric filters or other metric sources.

Full explanation →
349
MCQhard

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. Which solution meets these requirements?

A.Write a script that runs in each account using AWS Lambda to enable CloudTrail and point to the central bucket.
B.Use AWS Config rules in each account to check CloudTrail status and remediate via Lambda.
C.Use AWS CloudTrail with Organizations to create an organization trail that logs all accounts to the central bucket.
D.Create an IAM role that each account assumes to enable CloudTrail and log to the central bucket.
AnswerC

Creating an organization trail in the management account (with isOrganizationTrail set to true) automatically provisions CloudTrail for every current and future member account in AWS Organizations, delivering logs to a single central S3 bucket. Member account users—even those with administrative rights—cannot disable or alter the trail because ownership rests with the management account, eliminating the need for per-account configuration or remediation. This native, centralized governance model is exactly why recommended architectures consistently select this option over per-account scripts, roles, or Config checks.

Why this answer

AWS CloudTrail supports integration with AWS Organizations, allowing you to create an organization trail that automatically logs events for all accounts in the organization. This trail delivers log files to a single centralized S3 bucket in the management account without requiring per-account configuration, ensuring compliance with the security team's requirement.

Exam trap

The trap here is that candidates often assume they must enable CloudTrail individually in each account or use complex cross-account IAM roles, overlooking the native AWS Organizations integration that automatically applies a single trail to all accounts.

How to eliminate wrong answers

Option A is wrong because it relies on a script running in each account via Lambda, which is operationally complex, not scalable, and does not leverage the native multi-account capabilities of CloudTrail; it also risks missing accounts or failing to maintain consistent configuration. Option B is wrong because AWS Config rules can only detect and remediate non-compliance after the fact, not proactively enable CloudTrail across all accounts, and the remediation Lambda would need to be deployed in each account, adding overhead and potential latency. Option D is wrong because creating an IAM role for each account to assume does not automatically enable CloudTrail; it only provides permissions, and the actual enabling would still require manual or scripted actions in each account, failing to meet the requirement for a centralized, automated solution.

Full explanation →
350
Multi-Selectmedium

Which TWO actions are valid ways to enforce the principle of least privilege in an AWS environment?

Select 2 answers
A.Use the root user for daily administration
B.Use S3 bucket policies to allow all IAM users
C.Grant only the necessary actions in IAM policies
D.Use SCPs to deny actions that are not required
E.Assign the AdministratorAccess managed policy to all users
AnswersC, D

This directly applies least privilege.

Why this answer

Options C and D are correct. Option C is correct because IAM policies should grant only the necessary actions, adhering to least privilege. Option D is correct because SCPs can deny actions that are not required across accounts, enforcing least privilege at the organization level.

Option A is wrong because using the root user for daily administration grants unrestricted access, violating least privilege. Option B is wrong because S3 bucket policies that allow all IAM users do not restrict permissions per user. Option E is wrong because assigning the AdministratorAccess managed policy grants full access, contradicting least privilege.

Full explanation →
351
Multi-Selecthard

Which THREE are AWS best practices for securing an Amazon EC2 instance? (Choose three.)

Select 3 answers
A.Store database credentials in instance metadata for easy retrieval.
B.Launch instances in the default VPC for easier network configuration.
C.Use security groups to control inbound and outbound traffic.
D.Disable password-based authentication and use SSH key pairs instead.
E.Regularly apply security patches using AWS Systems Manager Patch Manager.
AnswersC, D, E

Security groups are the primary mechanism for controlling network traffic to EC2 instances.

Why this answer

Security groups act as a virtual firewall for an EC2 instance, controlling inbound and outbound traffic at the instance level. By default, security groups are stateful and allow only explicitly permitted traffic, which is a fundamental AWS best practice for network security. Using security groups helps implement the principle of least privilege by restricting access to only necessary ports and protocols.

Exam trap

The trap here is that candidates may think instance metadata is a secure place to store credentials because it is convenient, but AWS explicitly warns against this due to the risk of exposure through SSRF or other instance-level vulnerabilities.

Full explanation →
352
Multi-Selecthard

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to access an S3 bucket to store logs. The security team wants to ensure that traffic does not traverse the internet. Which solution should be used? (Choose two.)

Select 2 answers
A.Create an S3 Gateway Endpoint in the VPC
B.Attach a VPC Endpoint Policy to the Gateway Endpoint to restrict access to the specific bucket
C.Attach an Internet Gateway to the VPC
D.Create an S3 Interface Endpoint in the VPC
E.Use a NAT Gateway to route the traffic to the internet
AnswersA, B

Provides private connectivity to S3.

Why this answer

A VPC Gateway Endpoint (option A) allows instances in a private subnet to access S3 without traversing the internet by routing traffic through AWS's internal network. This is the correct foundational component because it uses prefix lists in the route table to direct S3 traffic to the endpoint, bypassing the need for an Internet Gateway or NAT Gateway.

Exam trap

The trap here is that candidates often confuse Gateway Endpoints with Interface Endpoints, assuming both are equally valid for S3, but Gateway Endpoints are the correct and cost-effective choice for S3 access from private subnets, while Interface Endpoints are used for services like API Gateway or Kinesis.

Full explanation →
353
Multi-Selecthard

A security engineer is designing a multi-account strategy using AWS Organizations. The engineer needs to centrally manage network security across all accounts. Which TWO AWS services are most appropriate for this task?

Select 2 answers
A.AWS Firewall Manager
B.AWS Network Firewall
C.VPC Peering
D.AWS WAF
E.Amazon GuardDuty
AnswersA, B

Firewall Manager provides centralized management of firewall rules across accounts and resources.

Why this answer

AWS Firewall Manager (Option A) provides centralized management of firewall rules and policies across accounts in AWS Organizations, enabling consistent enforcement of network security. AWS Network Firewall (Option B) offers managed network firewall services that can be centrally deployed and managed via Firewall Manager. Option C (VPC Peering) is a network connectivity feature, not a security management service.

Option D (AWS WAF) protects web applications at the application layer, not network-level security. Option E (Amazon GuardDuty) is a threat detection service, not a network security management tool.

Full explanation →
354
MCQhard

A company's security team is implementing a solution to automatically revoke public access to Amazon S3 buckets that become public. The solution must be serverless and use native AWS services. Which combination of services should be used?

A.Amazon S3 event notifications on ObjectCreated events to invoke a Lambda function
B.Amazon EventBridge (CloudWatch Events) to detect PutBucketPolicy events and invoke an AWS Lambda function to remove the policy
C.Amazon CloudWatch Logs with a metric filter and alarm to trigger an SNS notification
D.AWS Config with managed rule 's3-bucket-public-read-prohibited' and auto-remediation via Systems Manager
AnswerB

EventBridge captures API calls from CloudTrail and triggers Lambda to revert the public policy.

Why this answer

Amazon EventBridge (option B) can detect S3 bucket policy changes via CloudTrail (e.g., PutBucketPolicy events) and invoke an AWS Lambda function to remove the public policy, providing automatic remediation. Option A is incorrect because S3 event notifications on ObjectCreated only respond to object-level events, not bucket policy changes. Option C is incorrect because CloudWatch Logs with a metric filter and alarm can only send notifications, not directly remediate the bucket policy.

Option D is incorrect because while AWS Config can detect non-compliant buckets with the managed rule 's3-bucket-public-read-prohibited', automatic remediation typically requires a custom Lambda function or Systems Manager Automation, and the option specifies Systems Manager, which is not as serverless-native as using Lambda directly; moreover, the combination described does not automatically revoke access without additional components.

Full explanation →
355
MCQmedium

A company is designing an automated incident response workflow. When a high-severity GuardDuty finding is generated, the security team wants to automatically isolate the affected EC2 instance by modifying its security group to deny all traffic. Which service should orchestrate this response?

A.AWS Lambda
B.AWS Config
C.AWS Step Functions
D.AWS Systems Manager Automation
AnswerD

Automation provides predefined runbooks for incident response, including security group modification.

Why this answer

AWS Systems Manager Automation is the correct choice because it provides a pre-built runbook (AWS-DetachAndIsolateEC2Instance) that can be triggered by Amazon EventBridge when a GuardDuty finding is generated. This runbook automatically modifies the EC2 instance's security group to deny all traffic, effectively isolating the instance without requiring custom code. Systems Manager Automation is designed for such operational workflows, offering built-in error handling and approval steps.

Exam trap

The trap here is that candidates often choose AWS Lambda because they think they need custom code to modify security groups, overlooking that AWS Systems Manager Automation provides a purpose-built, no-code runbook for EC2 isolation that integrates directly with GuardDuty findings via EventBridge.

How to eliminate wrong answers

Option A is wrong because AWS Lambda is a serverless compute service for running code, but it would require you to write custom logic to modify security groups, handle API calls, and manage permissions, whereas Systems Manager Automation provides a ready-to-use runbook. Option B is wrong because AWS Config is a service for evaluating resource compliance against rules, not for orchestrating automated incident response actions like modifying security groups. Option C is wrong because AWS Step Functions is a workflow orchestration service that could coordinate multiple steps, but it lacks the pre-built runbook for EC2 isolation and would require you to build the entire workflow from scratch, including Lambda functions for each action.

Full explanation →
356
MCQmedium

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The security team wants to restrict access to the ALB so that it only accepts traffic from CloudFront. Which configuration should be used?

A.Configure the ALB to be internal and place it in a VPC with a CloudFront VPC origin.
B.Configure the ALB to require a specific header 'X-CloudFront-Origin' and reject requests without it.
C.Configure the ALB to use an IAM role that allows only CloudFront to invoke the ALB.
D.Configure the ALB security group to allow inbound traffic only from the CloudFront origin IP ranges published by AWS.
AnswerD

This is the correct and recommended approach: AWS publishes the complete set of CloudFront IP addresses used to fetch content from origins in the ip-ranges.json file, with a specific service indicator (CLOUDFRONT_ORIGIN_FACING). By adding a security group rule that allows inbound TCP 80/443 only from those CIDR blocks, the ALB will refuse connections from any other public IP, including direct internet clients that bypass CloudFront. You can implement this effectively using a managed prefix list that AWS keeps updated, or by periodically refreshing your security group rules from the published ranges.

Why this answer

CloudFront publishes a list of its origin-facing IP address ranges, and you can restrict the ALB's security group to allow inbound traffic only from those ranges. This ensures that only CloudFront can reach the ALB directly, preventing bypass attacks. AWS provides these IP ranges in the ip-ranges.json file, which can be used to automate security group updates.

Exam trap

The trap here is that candidates often confuse CloudFront's viewer-facing IP ranges with its origin-facing IP ranges, or they assume that a custom header (like 'X-CloudFront-Origin') is a built-in CloudFront feature, when in fact AWS recommends using security group restrictions as the primary defense.

How to eliminate wrong answers

Option A is wrong because CloudFront cannot use a VPC origin with an internal ALB; CloudFront origins must be publicly accessible over the internet, and internal ALBs are not reachable from CloudFront. Option B is wrong because there is no standard 'X-CloudFront-Origin' header; while you can use a custom header like 'X-Origin-Verify' to authenticate requests, this is not a built-in CloudFront feature and relies on a shared secret, which is less secure than network-layer restriction. Option C is wrong because IAM roles are used for API-level authorization (e.g., invoking Lambda functions), not for network traffic control to an ALB; ALBs do not evaluate IAM roles for incoming HTTP requests.

Full explanation →
357
MCQhard

A security engineer needs to design an IAM policy that allows an IAM user to launch EC2 instances only if they specify a specific security group ID (sg-12345) and a specific instance type (t2.micro). Which policy achieves this?

A.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:security-group/sg-12345", "Condition": { "StringEquals": { "ec2:InstanceType": "t2.micro" } } } ] }
B.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:InstanceType": "t2.micro", "aws:RequestTag/security-group": "sg-12345" } } } ] }
C.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:InstanceType": "t2.micro" } } } ] }
D.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "StringEquals": { "ec2:InstanceType": "t2.micro", "ec2:SecurityGroup": "sg-12345" } } } ] }
AnswerD

Correctly restricts both instance type and security group.

Why this answer

It uses the condition keys 'ec2:InstanceType' and 'ec2:SecurityGroup' to restrict the RunInstances action to only allow launching t2.micro instances into the security group sg-12345. Option A incorrectly specifies the security group as a resource ARN, but security groups cannot be specified as resources in RunInstances; they are specified via condition keys. Option B uses 'aws:RequestTag/security-group' which is not a valid condition key for security groups; security groups are identified by 'ec2:SecurityGroup'.

Option C only restricts instance type but does not restrict the security group. Therefore, only D correctly enforces both constraints.

Full explanation →
358
Multi-Selecthard

A security engineer is investigating a potential security incident. The engineer has enabled CloudTrail and VPC Flow Logs. Which THREE pieces of information can the engineer obtain from CloudTrail logs that are NOT available in VPC Flow Logs? (Choose three.)

Select 3 answers
A.The payload of the API request.
B.The AWS Region where the API call was made.
C.The destination IP address and port of the network traffic.
D.The IAM user or role that performed the API call.
E.The source IP address of the API call.
AnswersB, D, E

The AWS Region where the API call was made is a definitive field in CloudTrail's event history (the awsRegion attribute), whereas VPC Flow Logs are tied to a specific VPC and only describe traffic within that VPC's region. An API call's endpoint region may differ from the region of the VPC through which the traffic flows, so only CloudTrail provides this region information.

Why this answer

CloudTrail logs capture management-plane API calls, including the AWS Region where the call was made (via the 'awsRegion' field). VPC Flow Logs only capture network-level metadata (IP addresses, ports, protocols) and have no visibility into the AWS Region of an API call because they operate at Layer 3/4 of the OSI model and do not log control-plane events. Therefore, the Region information is uniquely available in CloudTrail.

Exam trap

The trap here is that candidates assume CloudTrail logs contain the full request payload (Option A) because they confuse CloudTrail with AWS Config or data-plane logging, but CloudTrail explicitly excludes payload data to avoid storing sensitive information.

Full explanation →
359
MCQhard

During an incident, a security engineer needs to isolate a compromised Amazon EC2 instance without losing the ability to capture forensic data from its EBS volumes. What is the best course of action?

A.Terminate the instance immediately and take a snapshot after termination.
B.Take a snapshot of the EBS volumes, then detach the instance from the Auto Scaling group and modify the security group to deny all traffic.
C.Stop the instance, detach the volumes, and attach them to a forensic instance.
D.Change the security group to restrict traffic to only the forensic team's IP addresses.
AnswerB

This is the correct order: first snapshot the EBS volumes to preserve point-in-time disk evidence before any destructive or state-changing action occurs, then detach the instance from the Auto Scaling group so it won't be terminated or replaced by the group, and finally modify the security group by removing all inbound and outbound allow rules to block all network traffic and isolate the host.

Why this answer

Taking a snapshot of the EBS volumes preserves the forensic data before any changes occur, while detaching the instance from the Auto Scaling group prevents automatic replacement, and modifying the security group to deny all traffic isolates the instance without losing the running state or the ability to capture additional volatile data. This approach balances isolation with forensic preservation, ensuring the instance remains available for further analysis if needed.

Exam trap

The trap here is that candidates often confuse 'stopping' an instance with 'isolating' it, not realizing that stopping triggers OS shutdown processes that can destroy volatile evidence, whereas modifying the security group to deny all traffic achieves isolation without altering the instance state.

How to eliminate wrong answers

Option A is wrong because terminating the instance destroys the running state and any volatile data (e.g., memory, process list), and while a snapshot can be taken after termination, the EBS volumes may have been altered or deleted, losing critical forensic evidence. Option C is wrong because stopping the instance clears the instance store (if used) and may trigger OS-level shutdown scripts that could overwrite or delete forensic data; detaching volumes and attaching them to a forensic instance is a valid step but should be done after taking a snapshot to ensure a point-in-time copy, and stopping the instance is unnecessary and risky. Option D is wrong because restricting traffic to only the forensic team's IP addresses does not fully isolate the instance from lateral movement or external threats; the instance remains accessible and could still be compromised or used as a pivot point, and it does not prevent the instance from being terminated or altered by an attacker.

Full explanation →
360
MCQhard

A company uses AWS Key Management Service (KMS) to encrypt data at rest. The security team needs to ensure that only specific IAM roles can use a particular KMS key to encrypt and decrypt data. What is the most secure way to achieve this?

A.Create an IAM policy that allows kms:Encrypt and kms:Decrypt for the roles and attach it to the roles.
B.Create a KMS key policy that grants access only to the specific IAM roles using the kms:CallerArn condition.
C.Create a KMS key policy that grants access to the account and use IAM policies to restrict the roles.
D.Create a KMS key policy with Principal "*" and a condition that the request originates from the roles.
AnswerB

This restricts key usage to the specified roles.

Why this answer

Using a key policy with a condition for the kms:CallerArn attribute restricts usage to the specified roles. Option A is wrong because IAM policies alone cannot restrict KMS key usage if the key policy allows all principals. Option C is wrong because key policy with Principal "*" grants access to all, even with a condition.

Option D is wrong because a condition for the IAM role's ARN is not a standard KMS condition key.

Full explanation →
361
MCQmedium

Refer to the exhibit. An IAM policy is attached to a group. An IAM user in that group attempts to stop an EC2 instance from IP address 198.51.100.10. What will happen?

A.The action is allowed because the first statement allows StopInstances
B.The action is allowed because the resource is '*'
C.The action is denied because the source IP does not match the allowed range
D.The action is denied only if the user is not using MFA
AnswerC

The Deny statement blocks requests from IPs not in the allowed range.

Why this answer

The IAM policy includes a `Deny` statement with a `NotIpAddress` condition that restricts all actions (including `StopInstances`) to the IP range `10.0.0.0/8`. Since the user's source IP is `198.51.100.10`, which falls outside this range, the deny statement explicitly blocks the action. In IAM, an explicit deny always overrides any allow, so the request is denied regardless of the allow statement in the first policy block.

Exam trap

The trap here is that candidates assume the allow statement with `Effect: Allow` and `Action: ec2:StopInstances` will grant permission, forgetting that an explicit deny with a condition that does not match the request context takes precedence over any allow.

How to eliminate wrong answers

Option A is wrong because the explicit deny statement with the `NotIpAddress` condition overrides the allow statement; IAM evaluates deny before allow, and an explicit deny cannot be bypassed by a separate allow. Option B is wrong because while the resource is `*`, the deny statement applies to all resources and actions, and the condition key `aws:SourceIp` is evaluated against the source IP, not the resource ARN. Option D is wrong because the policy does not include any condition requiring MFA (`aws:MultiFactorAuthPresent`); the denial is based solely on the source IP mismatch.

Full explanation →
362
Multi-Selecthard

A company is designing a centralized logging solution for multiple AWS accounts. The logs must be encrypted at rest and in transit, and access must be audited. Which TWO actions should be taken? (Choose TWO.)

Select 2 answers
A.Configure cross-account CloudWatch Logs subscription to aggregate logs centrally.
B.Enable S3 server access logs on the central bucket for auditing.
C.Configure the S3 bucket policy to restrict PutObject to the CloudTrail service principal with a condition on aws:SourceArn.
D.Use AWS KMS customer managed keys (CMK) to encrypt the central S3 bucket.
E.Use VPC endpoints to ensure logs are transmitted over the AWS network.
AnswersC, D

Correct. A bucket policy with PutObject restricted to the CloudTrail service principal and a condition on aws:SourceArn ensures only authorized CloudTrail trails can deliver logs, providing secure aggregation and auditability.

Why this answer

To centrally aggregate logs from multiple AWS accounts while ensuring encryption at rest and in transit, and auditing access, two key actions are required. First, configure the central S3 bucket with a bucket policy that restricts PutObject to the CloudTrail service principal with a condition on aws:SourceArn (Option C). This ensures only the intended CloudTrail trails from designated accounts can write logs, providing security and auditability.

Second, use AWS KMS customer managed keys (CMK) to encrypt the central S3 bucket (Option D). This gives you control over the encryption keys and enables auditing of key usage via CloudTrail. Option A is incorrect because cross-account CloudWatch Logs subscription requires additional configuration and does not inherently provide encryption at rest with KMS control.

Option B is wrong because enabling S3 server access logs does not encrypt the logs nor restrict write access; it logs access to the bucket itself. Option E is incorrect because VPC endpoints ensure traffic stays within the AWS network but do not provide encryption at rest or the granular write restrictions needed.

Full explanation →
363
MCQeasy

A company is using Amazon S3 to store confidential documents. They want to ensure that all data is encrypted in transit between the S3 bucket and their on-premises application. Which of the following should be enforced?

A.Add a bucket policy that denies access unless 'aws:SecureTransport' is true.
B.Use Amazon CloudFront with a custom origin pointing to the S3 bucket.
C.Use a VPC endpoint for S3.
D.Enable default encryption (SSE-S3) on the bucket.
AnswerA

This enforces HTTPS for all requests to the bucket.

Why this answer

The 'aws:SecureTransport' condition in a bucket policy enforces HTTPS for all requests, ensuring encryption in transit. Option B is incorrect because CloudFront does not enforce HTTPS between CloudFront and the S3 origin by default; it can be configured but is not enforced solely by this option. Option C is incorrect because a VPC endpoint for S3 uses HTTPS by default, but does not enforce it; bucket policies are still needed.

Option D is incorrect because SSE-S3 encrypts data at rest, not in transit.

Full explanation →
364
MCQmedium

The exhibit shows an SCP attached to an organizational unit. What is the effect of this policy?

A.It allows s3:PutBucketPolicy only if the bucket ACL is set to bucket-owner-full-control.
B.It denies all s3:PutBucketPolicy actions on all buckets.
C.It denies s3:PutBucketPolicy for any bucket that does not have an ACL.
D.It allows s3:PutBucketPolicy for buckets owned by the management account.
AnswerA

The Deny is conditional; if the condition is not met (i.e., ACL is correct), the action is allowed.

Why this answer

The SCP denies s3:PutBucketPolicy only when the bucket ACL is not set to 'bucket-owner-full-control'. If the ACL is set to that value, the action is allowed. Thus, it ensures that when a bucket policy is created, the ACL must grant full control to the bucket owner.

It does not deny all PutBucketPolicy actions.

Full explanation →
365
MCQhard

A security engineer is designing an incident response plan for a containerized application running on Amazon ECS with Fargate. The engineer needs to ensure that if a container is compromised, the incident response team can capture a memory dump and disk snapshot for forensic analysis. The containers are stateless and use ephemeral storage. Which approach provides the necessary forensic data?

A.Configure the container to stream /dev/mem to CloudWatch Logs.
B.Enable ECS task memory dumps to CloudWatch Logs.
C.Use ECS Exec to access the container and capture a memory dump; snapshot the task's ephemeral storage.
D.Stop the task and create a new task from the same image.
AnswerC

ECS Exec uses the ExecuteCommand API to open an interactive shell in a running container without opening inbound ports, allowing you to run forensic utilities like 'dd' or 'gcore' to capture volatile memory from inside the container's PID namespace. Before the task is stopped, you can also snapshot the task's ephemeral storage by copying files to an external volume or using an EBS-optimized instance to preserve the disk state. This preserves both volatile and persistent evidence, unlike stopping the task first.

Why this answer

ECS Exec allows interactive access to a running container without stopping it, enabling the capture of a memory dump (e.g., via `gcore` or `/proc/kcore`). Additionally, the task's ephemeral storage can be snapshotted while the container is still running, preserving disk state for forensic analysis. This approach aligns with incident response best practices for stateless containers on Fargate, where traditional host-level forensics are unavailable.

Exam trap

The trap here is that candidates assume stopping the task (Option D) is safe because containers are stateless, but they overlook that forensic data (memory and ephemeral disk) is lost upon task termination, making live capture via ECS Exec (Option C) the only viable method.

How to eliminate wrong answers

Option A is wrong because `/dev/mem` is not accessible in Fargate containers (no kernel-level access) and streaming it to CloudWatch Logs would not produce a usable memory dump; CloudWatch Logs is for log data, not binary forensic artifacts. Option B is wrong because ECS does not have a native feature to send task memory dumps to CloudWatch Logs; memory dumps require explicit capture via tools like `gcore` or `dd` from within the container. Option D is wrong because stopping the task destroys the ephemeral storage and the container's memory, losing all forensic evidence; creating a new task from the same image provides no snapshot of the compromised state.

Full explanation →
366
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants a centralized view of all security alerts and findings from services like GuardDuty, Security Hub, and Inspector across all accounts. What is the MOST efficient way to achieve this?

A.Use AWS Systems Manager OpsCenter to centrally view all security findings.
B.Use individual service consoles (GuardDuty, Security Hub, Inspector) for each account.
C.Use Amazon CloudWatch Logs to collect logs from each account and create custom dashboards.
D.Use AWS Security Hub with cross-account aggregation in the management account.
AnswerD

Security Hub can aggregate findings from multiple accounts and services into a single dashboard.

Why this answer

AWS Security Hub is designed to aggregate findings from multiple security services (GuardDuty, Inspector, etc.) across accounts. By enabling cross-account aggregation in the management account of AWS Organizations, Security Hub provides a single, centralized dashboard for all security alerts and findings without needing to collect raw logs or build custom dashboards. This is the most efficient and native approach for a multi-account environment.

Exam trap

The trap here is that candidates may think CloudWatch Logs or OpsCenter are suitable for centralized security findings, but they lack the native cross-account aggregation and structured finding format that Security Hub provides, which is the most efficient and purpose-built solution.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager OpsCenter is primarily for operational issues and incident management, not for aggregating security findings from GuardDuty, Security Hub, or Inspector across accounts; it lacks native cross-account security finding aggregation. Option B is wrong because using individual service consoles for each account is inefficient and does not provide a centralized view; it requires manual logins and lacks cross-account aggregation. Option C is wrong because Amazon CloudWatch Logs can collect logs, but building custom dashboards for security findings is complex, requires additional parsing, and does not natively aggregate structured findings from GuardDuty, Security Hub, or Inspector as Security Hub does.

Full explanation →
367
MCQmedium

Refer to the exhibit. A security engineer runs the 'simulate-custom-policy' command to test a policy. The output shows 'explicitDeny' for ec2:RunInstances. What is the most likely reason?

A.The policy does not include ec2:RunInstances in the Action list
B.The policy includes an explicit Deny statement for ec2:RunInstances
C.The policy allows ec2:Describe* but the action ec2:RunInstances is not a Describe action
D.The policy uses a Resource of '*' which does not include the required resources
AnswerB

The 'explicitDeny' result directly corresponds to an explicit Deny statement in the policy that denies ec2:RunInstances.

Why this answer

The 'simulate-custom-policy' output shows 'explicitDeny', which indicates that the policy contains an explicit Deny statement for the action ec2:RunInstances. An explicitDeny is only returned when a Deny statement matches the action, not when the action is simply missing from an Allow list. Therefore, the most likely reason is that the policy includes an explicit Deny statement.

Exam trap

A common trap is confusing 'explicitDeny' with 'implicitDeny'. An explicitDeny only occurs when an actual Deny statement in the policy or identity-based policy denies the action. A missing allow leads to an implicitDeny, not explicitDeny.

Full explanation →
368
MCQmedium

Refer to the exhibit. A security engineer deploys this CloudFormation template. An IAM role 'DataAccessRole' in the same account needs to read objects from the bucket. After deployment, users assume the role but get AccessDenied errors when trying to read objects. What is the MOST likely cause?

A.The IAM role is not attached to the EC2 instance profile.
B.The bucket is encrypted with SSE-KMS and the role lacks KMS permissions.
C.The PublicAccessBlockConfiguration is blocking the bucket policy.
D.The role does not have s3:ListBucket permission.
AnswerC

The settings BlockPublicPolicy and RestrictPublicBuckets can prevent the policy from granting access even to specific roles.

Why this answer

The PublicAccessBlockConfiguration at the account or bucket level overrides any bucket policy that grants public or cross-account access. Even though the bucket policy may allow the DataAccessRole to read objects, the PublicAccessBlockConfiguration blocks all public or cross-account access, causing AccessDenied errors. This is the most likely cause because the bucket policy is effectively ignored when public access blocks are enabled.

Exam trap

The SCS-C02 exam often tests the misconception that a bucket policy alone is sufficient to grant cross-account access, without considering that PublicAccessBlockConfiguration can silently override it, leading candidates to overlook this setting.

How to eliminate wrong answers

Option A is wrong because the IAM role is not attached to an EC2 instance profile; the role is assumed directly by users, not by an EC2 instance, so an instance profile is irrelevant. Option B is wrong because there is no mention of SSE-KMS encryption in the exhibit, and the error is AccessDenied, not a KMS-related permission error (which would typically be a different error message). Option D is wrong because the s3:ListBucket permission is required for listing objects, not for reading individual objects; the error occurs when trying to read objects, which requires s3:GetObject, not s3:ListBucket.

Full explanation →
369
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to centralize the collection of VPC Flow Logs and AWS CloudTrail logs from all accounts into a single Amazon S3 bucket in the management account. The S3 bucket policy must allow cross-account log delivery. Which condition in the bucket policy should be used to restrict log delivery to only the organization's accounts?

A.aws:SourceArn
B.aws:SourceOrgId
C.aws:SourceAccount
D.aws:PrincipalOrgID
AnswerD

aws:PrincipalOrgID is a global IAM condition key that compares the unique organization ID of the principal's AWS account to the value you specify. In an S3 bucket policy, setting "aws:PrincipalOrgID": "o-12345" allows any principal from any account within that organization to deliver logs, automatically covering new accounts as they join. Because it operates on the principal's organization rather than the request source, it is the most scalable and appropriate condition for this cross-account logging scenario.

Why this answer

The correct condition key is `aws:PrincipalOrgID`, which restricts access to principals (accounts, IAM roles, or users) that are members of the specified AWS Organization. When used in a bucket policy, it ensures that only accounts within the company's organization can deliver logs to the S3 bucket, even if the source account ID changes. Note that `aws:SourceOrgId` is not a valid AWS condition key; `aws:PrincipalOrgID` is the appropriate key for this purpose.

Exam trap

Candidates often confuse `aws:PrincipalOrgID` with `aws:SourceOrgId`. However, `aws:SourceOrgId` is not a valid AWS condition key. The correct key for restricting based on organization membership is `aws:PrincipalOrgID`.

For cross-account log delivery, `aws:PrincipalOrgID` ensures that only accounts within the specified organization can perform the action.

How to eliminate wrong answers

Option A is wrong because `aws:SourceArn` is used to restrict access based on the exact ARN of the resource making the request, which is not suitable for cross-account log delivery from multiple accounts where the source ARN varies. Option C is wrong because `aws:SourceAccount` restricts based on a single AWS account ID, which would require listing every account in the organization and would not automatically include new accounts added later. Option D is wrong because `aws:PrincipalOrgID` is the correct key, but the option is mislabeled as `aws:SourceOrgId` in the question; the actual correct key is `aws:PrincipalOrgID`, not `aws:SourceOrgId`.

Full explanation →
370
Multi-Selectmedium

A company needs to ensure that all API calls made to AWS are logged and that the logs are immutable. Which TWO steps should be taken? (Choose TWO.)

Select 2 answers
A.Enable CloudTrail log file validation.
B.Enable AWS CloudTrail in all regions.
C.Store CloudTrail logs in an S3 bucket with Object Lock enabled in Compliance mode.
D.Send CloudTrail logs to CloudWatch Logs with a retention policy.
E.Enable S3 versioning on the destination bucket.
AnswersB, C

CloudTrail logs all API calls across regions.

Why this answer

Enabling AWS CloudTrail in all regions ensures that all management events across every region are logged, which is essential for comprehensive security monitoring and compliance. However, note that data events (e.g., S3 object-level operations) require explicit configuration in the trail. Option C is correct because storing CloudTrail logs in an S3 bucket with Object Lock enabled in Compliance mode prevents any user, including the root user, from deleting or overwriting log files, ensuring immutability.

Together, these steps satisfy the requirement that all API calls are logged and the logs are immutable.

Exam trap

The trap here is that candidates often confuse log file validation (integrity checks) with immutability (prevention of deletion/modification), or assume that versioning alone provides sufficient protection against log tampering, when in fact only Object Lock in Compliance mode enforces true WORM immutability.

Full explanation →
371
Multi-Selecthard

A company is designing a disaster recovery plan for encrypted Amazon EBS volumes. Which THREE steps are required to ensure that encrypted EBS snapshots can be restored in a different AWS Region?

Select 2 answers
A.Re-encrypt the snapshot with a customer managed key (CMK) in the target region
B.Copy the encrypted snapshot to the target AWS Region
C.Store the encryption key in AWS CloudHSM in the target region
D.Ensure the CMK used for encryption is available in the target region
E.Share the snapshot with the target region using AWS RAM
AnswersB, D

The encrypted snapshot must be copied to the target region as the first step in the restoration process.

Why this answer

To restore encrypted EBS snapshots in a different AWS Region, you must copy the encrypted snapshot to the target region (B) and ensure the customer managed key (CMK) used for encryption is available in the target region (D). Re-encrypting the snapshot with a CMK in the target region (A) is optional if you want to use a different key, but it is not a required step. Options C and E are incorrect because AWS CloudHSM is not used for EBS encryption and sharing snapshots via AWS RAM does not guarantee key availability.

Full explanation →
372
Multi-Selecthard

A security engineer is investigating a potential data exfiltration incident. The engineer notices large volumes of data being transferred from an Amazon S3 bucket to an external IP address. Which AWS services can be used to detect and alert on such behavior? (Choose THREE.)

Select 3 answers
A.Amazon CloudWatch Logs with S3 access log analysis.
B.AWS CloudTrail with S3 data event logging.
C.Amazon GuardDuty with anomaly detection.
D.AWS Config with compliance rules.
E.VPC Flow Logs.
AnswersA, B, C

S3 server access logs can be sent to CloudWatch Logs for monitoring and alerting.

Why this answer

Amazon CloudWatch Logs can ingest and analyze S3 access logs, which record detailed information about requests made to an S3 bucket, including the source IP address, request type, and bytes transferred. By analyzing these logs with CloudWatch Logs Insights or metric filters, you can detect large data transfers to external IPs and trigger alerts via CloudWatch Alarms, making it a valid detection and alerting mechanism for data exfiltration.

Exam trap

The trap here is that candidates may think VPC Flow Logs (Option E) are sufficient for S3 data exfiltration detection, but they lack the application-layer context needed to identify S3-specific operations and external IPs in S3 access logs or CloudTrail events.

Full explanation →
373
MCQmedium

A company uses AWS Organizations with multiple accounts. The security team wants to detect and automatically respond to suspicious API calls across all accounts. Which solution is the MOST efficient and scalable?

A.Use AWS Config rules to detect API calls and trigger Lambda functions
B.Deploy Amazon GuardDuty and use its automated response feature
C.Create a CloudTrail trail in each account and aggregate logs via cross-account S3 bucket
D.Enable AWS CloudTrail organization trail and use Amazon EventBridge to invoke automated responses
AnswerD

Enabling an AWS CloudTrail organization trail in the management account automatically delivers log files for all accounts in the AWS Organization to a single S3 bucket, centralizing API activity without per-account setup. Amazon EventBridge can then ingest CloudTrail events and use rules to match specific API calls, triggering automated responses via targets like Lambda functions, Step Functions, or SNS topics. This native integration provides real-time, account-wide monitoring and response, making it the recommended and most scalable pattern.

Why this answer

Enabling an AWS CloudTrail organization trail centrally logs all API calls from every account in the AWS Organization into a single Amazon S3 bucket and CloudWatch Logs log group. Amazon EventBridge can then be used to create event rules that match specific suspicious API calls (e.g., IAM DeleteRolePolicy) and automatically invoke target actions like AWS Lambda functions or AWS Systems Manager Automation, providing a scalable, centralized, and efficient detection and response mechanism without per-account management overhead.

Exam trap

The trap here is that candidates often confuse AWS Config rules (which evaluate configuration drift) with CloudTrail (which records API activity), or assume that GuardDuty's threat detection includes built-in automated response capabilities, when in fact both require EventBridge for custom automation, making the centralized CloudTrail organization trail plus EventBridge the most efficient and scalable solution.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are designed to evaluate resource configurations and compliance, not to detect real-time API calls; they cannot directly capture or react to API events like CloudTrail does. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes DNS logs, VPC Flow Logs, and CloudTrail events for malicious activity, but it does not have a built-in 'automated response feature' for triggering custom remediation actions; any automated response would require integration with EventBridge or Lambda, making this option incomplete and less direct. Option C is wrong because creating a separate CloudTrail trail in each account and aggregating logs via a cross-account S3 bucket introduces significant operational overhead, duplication, and potential for inconsistent configuration, whereas an organization trail provides a single, automatically replicated trail across all accounts with no per-account setup.

Full explanation →
374
MCQmedium

Refer to the exhibit. A security engineer creates the S3 bucket policy above to allow an IAM role to upload objects only from the corporate network IP range (10.0.0.0/16). However, users report that they can still upload objects from outside the range when assuming the role. What is the most likely cause?

A.The condition key aws:SourceIp does not support the IP range 10.0.0.0/16 because it is a private IP range.
B.The bucket policy uses Allow instead of Deny; an explicit Deny is needed to block requests that do not meet the condition.
C.The IAM role's trust policy does not restrict who can assume the role.
D.The resource ARN should not include the trailing /*.
AnswerB

Because the IAM role already has an Allow, an Allow with condition does not restrict; a Deny is required.

Why this answer

An S3 bucket policy with an Allow effect grants access to anyone who meets the condition, but it does not explicitly deny requests that do not meet the condition. In IAM and resource-based policies, an Allow that includes a condition only applies when the condition is true; if the condition is false, the Allow is not evaluated, but other policies (like the IAM role's permissions) may still grant access. To block uploads from outside the corporate IP range, an explicit Deny with the same condition (or a NotIpAddress condition) is required to override any other Allow that might apply.

Exam trap

The trap here is that candidates assume an Allow with a condition implicitly denies all other requests, but AWS policy evaluation requires an explicit Deny to block access that does not meet the condition.

How to eliminate wrong answers

Option A is wrong because the aws:SourceIp condition key supports private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) when the request originates from within a VPC or corporate network; the limitation is that aws:SourceIp cannot be used for requests that come through a VPC endpoint (where aws:VpcSourceIp should be used instead), but private IP ranges are otherwise valid. Option C is wrong because the IAM role's trust policy controls who can assume the role, not the network source of the request; even if the trust policy is restrictive, the bucket policy's Allow condition is still insufficient to block uploads from outside the IP range. Option D is wrong because the resource ARN with a trailing /* is correct for granting access to all objects within the bucket; omitting the /* would restrict the policy to the bucket itself (e.g., s3:ListBucket), not to object-level actions like s3:PutObject.

Full explanation →
375
MCQmedium

Refer to the exhibit. A security engineer ran this AWS CLI command to find when a specific CreateKeyPair API call was made. The command returns no results, even though the engineer knows the call was made. What is the MOST likely reason?

A.The time range is too narrow.
B.The command did not specify a region, so it defaults to us-east-1, but the call was made in a different region.
C.The event name should be 'CreateKeypair' (lowercase p).
D.The --lookup-attributes parameter has incorrect syntax.
AnswerD

The comma should be a space or the syntax is wrong.

Why this answer

The `--lookup-attributes` parameter requires a JSON structure with an `AttributeKey` and `AttributeValue`. The provided syntax `--lookup-attributes EventName=CreateKeyPair` is invalid; the correct format is `--lookup-attributes AttributeKey=EventName,AttributeValue=CreateKeyPair`. This malformed parameter causes the AWS CLI to fail silently or return no results, even though the API call exists.

Exam trap

The trap here is that candidates assume the `--lookup-attributes` parameter accepts simple key=value syntax like other AWS CLI commands, but CloudTrail requires a specific `AttributeKey` and `AttributeValue` pair, and failing to use this correct structure silently returns no results instead of an error.

How to eliminate wrong answers

Option A is wrong because the time range is specified as `--start-time` and `--end-time` covering a 24-hour window, which is not too narrow for a known call made within that period. Option B is wrong because the `aws cloudtrail lookup-events` command does not require a `--region` flag; it defaults to the region configured in the AWS CLI profile, and the engineer would have received an error or empty results if the region mismatch caused no events, but the command returns no results at all, not an error. Option C is wrong because the event name in CloudTrail is case-sensitive and stored as `CreateKeyPair` (capital P), matching the command; using lowercase 'p' would actually cause a mismatch, but the command uses correct casing.

Full explanation →
Page 4

Page 5 of 6

Page 6

All pages

123456

Practice SCS-C02 by domain

Target a specific domain to shore up weak areas.

Threat Detection and Incident ResponseSecurity Logging and MonitoringIdentity and Access ManagementManagement and Security GovernanceInfrastructure SecurityData Protection
See all domains with question counts →