AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 376–450

AWS Config continuously evaluates keys against a custom rule and auto-remediation invokes a remediation action to disable non-compliant keys, removing manual checks. This satisfies the 90-day rotation requirement with least operational overhead, since detection and disabling happen automatically without custom scheduling infrastructure.

For SAML federation, the correct pattern is an IAM role with a trust policy that grants sts:AssumeRoleWithSAML to the SAML identity provider you create in IAM. The corporate Active Directory is the external IdP (for example, AD FS or Shibboleth), and the trust policy uses the IAM SAML provider's ARN as the principal, often with an audience condition of urn:amazon:webservices. When a user authenticates to AD, the IdP issues a SAML assertion, AWS validates it against the SAML provider, and the user receives temporary credentials scoped by that role's permissions. This achieves single sign-on without creating or maintaining AWS credentials for each AD user.

To stream logs, Lambda's execution role must have IAM permissions for logs:CreateLogStream and logs:PutLogEvents on the target log group. Even when the log group exists, a restrictive or missing execution role policy prevents the log stream from being created, so no logs appear. Because no log streams exist despite the log group being present, the most plausible root cause is that the role lacks the necessary CloudWatch Logs permissions.

Private subnets lack a route to the internet, so their route tables must direct 0.0.0.0/0 to the central NAT device's elastic network interface. This satisfies the requirement that all outbound traffic traverses the NAT for logging and filtering.

Deleting the CloudHSM backup from the backup service ensures that the copied encrypted key material that was exfiltrated cannot be restored to a new or existing HSM, eliminating the attacker's ability to recover the keys. After that, rotating every key that was stored in the HSM—generating new keys and re-encrypting data with them—renders any previously copied key material useless because the data is now protected by fresh keys. This two-step approach directly addresses both ways the compromise can be exploited: backup restoration and continued use of the old key material.

A bucket policy that explicitly denies requests when aws:SecureTransport equals false is correct because aws:SecureTransport is a global IAM condition key that is true for HTTPS and false for HTTP. Using a Bool condition with a Deny effect overrides any other allow statement in the policy, so every S3 operation, including from authorized IAM principals, must arrive over TLS. This is the standard way to enforce HTTPS at the S3 API level, and it cannot be bypassed by accessing the bucket directly.

Bucket policies that deny s3:PutObject unless the request includes encryption headers block unencrypted uploads at the authorisation layer, enforcing encryption at rest for every write. This satisfies the requirement to prevent plaintext objects from being stored.

AWS CloudTrail captures all supported API calls as events, and CloudWatch Events (or EventBridge) can filter those events by service, action, and other fields using event patterns. Once matched, a rule can immediately invoke a Lambda function, SNS topic, or SQS queue to deliver the notification. This combination provides near-real-time alerting on specific API calls, which is exactly what the security team needs.

Designating a delegated administrator allows a member account to manage GuardDuty for the entire organization. The administrator can enable GuardDuty for all existing and new accounts automatically. Findings from all accounts are aggregated in the delegated administrator account, providing central visibility. This is the recommended approach for multi-account GuardDuty management.

This is correct. SSE is a per-queue setting, so enabling it on the source queue does not automatically protect the DLQ. When a message is redriven, SQS decrypts it from the source queue and writes it to the DLQ using whatever encryption the DLQ has configured. If the DLQ has no SSE, the message is stored as plaintext, directly violating the company's requirement that messages be encrypted at rest.

AWS Identity and Access Management (IAM) is correct because MFA enforcement is implemented with an identity-based policy that uses the global condition key aws:MultiFactorAuthPresent. You attach a Deny statement with "BoolIfExists": {"aws:MultiFactorAuthPresent": "false"} to a user or group, which blocks every API action unless the principal signed in with a valid MFA token. This makes MFA a native part of IAM's authentication and authorization flow, directly satisfying the company's requirement for all IAM users.

Amazon EventBridge and Amazon Simple Notification Service (SNS) form the canonical real-time alerting pattern for GuardDuty. GuardDuty automatically publishes every finding to the default EventBridge bus, and a rule can filter on fields like severity, finding type, or affected resource before targeting an SNS topic. SNS then fans out the notification to email, SMS, HTTP/S endpoints, or mobile push, ensuring security analysts are immediately notified without custom code or polling. This native integration is the recommended and fully managed approach.

Adding a route to the private subnet's route table with destination 0.0.0.0/0 and target the NAT gateway is the precise mechanism that enables outbound internet access from private instances. The NAT gateway itself resides in a public subnet and relies on its own route to the internet gateway, but private subnets require this explicit route to direct traffic to the NAT gateway. Without this route, private instances have no path to the internet, making this the correct action to satisfy the requirement.

In a GuardDuty multi-account setup, the administrator account sends invitations to member accounts. Each member account must explicitly enable GuardDuty and accept the invitation before it can begin sending findings to the administrator. If a member account has not enabled GuardDuty or has not accepted the invitation, no findings are received from that account. This is the most common reason for missing findings in the administrator console.

Amazon CloudWatch Logs Insights is a log query and analysis engine, not a purpose-built threat detection service. While it can search CloudTrail logs if they are streamed to Amazon CloudWatch Logs, it lacks GuardDuty's machine-learning models, anomaly detection, and integrated threat intelligence to automatically identify suspicious API activity. It requires you to manually craft queries based on prior knowledge of attack patterns, making it a reactive tool rather than a proactive detector of malicious behavior.

sourceIPAddress is the dedicated top-level field in CloudTrail log events that holds the IP address from which the API call was made. This is the exact field a security engineer should examine to identify the origin of a request, whether it comes from a user's public IP, a NAT gateway address, or an AWS service's internal IP. For console-session actions, CloudTrail populates this field with the IP of the user's browser, making it the authoritative source for network origin in log review.

VPC Flow Logs are the native AWS feature that captures IP traffic information for network interfaces in a VPC, recording metadata such as source and destination IP addresses, source and destination ports, protocol, and whether the traffic was accepted or rejected. These logs can be published to Amazon CloudWatch Logs or Amazon S3, where they can be analyzed with CloudWatch Logs Insights, Athena, or third-party tools to detect anomalous outbound connections like data exfiltration or beaconing. Because they capture all network flows at the ENI level, they are the appropriate service for monitoring unusual outbound traffic.

AWS Security Hub is the correct choice because it is purpose-built to aggregate security findings from AWS native services and third-party partner products into one place, while supporting multi-account architectures through a delegated administrator and cross-region finding aggregation. It consolidates alerts into the AWS Foundational Security Best Practices, CIS, and PCI DSS standards, and outputs normalized findings via the Security Finding Format API, making it the central command console for security status across the organization.

A NAT Gateway is a fully managed AWS service that enables instances in a private subnet to initiate outbound connections to the internet while preventing unsolicited inbound connections. It sits in a public subnet, uses an Elastic IP for source NAT, and forwards traffic through the Internet Gateway. Because it preserves the flow state, return traffic from the internet is translated back to the private instance, but no external host can directly initiate a session into the private subnet.

Transit Gateway with appliance mode enables asymmetric routing support, allowing a gateway route table to forward traffic from source VPCs to the central inspection VPC, while the firewall appliance then routes return traffic back through the same appliance, ensuring both directions are inspected. By using separate route tables associated with each VPC attachment, you can force all inter-VPC and outbound traffic through the firewall appliance, which scales horizontally and keeps security inspection centralized.

The kms:ViaService condition restricts key usage to requests routed through S3, while the principal or ARN condition limits decryption to the named IAM role. Together they enforce least privilege, ensuring no other principal or direct KMS call can decrypt the bucket's objects.

S3 event notifications can be configured to publish PUT or POST events to AWS Lambda, triggering a function each time an object is uploaded. The Lambda function can then use GetObject to retrieve the object and run a malware scanning engine such as ClamAV, applying tags or deleting/quarantining the object based on the scan verdict. This serverless, event-driven pattern provides immediate, per-object inspection and scales automatically with upload volume.

This is correct: an overly broad trust policy—for example `"Principal": "*"` without restrictive conditions—allows any AWS principal from any account to call `sts:AssumeRole` and obtain the role's temporary security credentials. Once assumed, the attacker receives all permissions attached to the role, enabling unauthorized actions in the account. In the absence of conditions like `aws:PrincipalArn`, `aws:PrincipalAccount`, or an external ID, there is no mechanism to distinguish legitimate principals from external attackers, so the role effectively exposes its permissions to the entire AWS ecosystem.

By designating a delegated administrator for GuardDuty in AWS Organizations, you centralize management and allow GuardDuty to automatically enable itself for all existing and future accounts. This creates a single detector per region in the delegated admin account with all member accounts linked underneath, so findings are aggregated without manual per-account setup. This is the native, supported pattern for scaling GuardDuty across an organization.

Setting a custom IAM password policy is the native, account-wide control that enforces minimum length, complexity, rotation, and reuse restrictions for all IAM users. When any IAM user creates a password or resets a forgotten one, IAM evaluates it against this policy and rejects non-compliant choices, so it directly satisfies the requirement. It is the only option that applies automatically to every new user without custom infrastructure or reliance on post-creation events.

CloudTrail records API activity across the account, including every IAM policy creation, modification and deletion, capturing the identity, timestamp and request parameters. This satisfies the audit requirement by providing a tamper-evident log of who changed which policy and when.

Tag-based SCPs allow fine-grained control across accounts.

Capturing memory first preserves volatile data such as running processes and credentials that are lost on shutdown. EBS snapshots of all volumes preserve persistent disk state, and recording metadata and network connections captures context. Isolating with a quarantine security group stops further communication without destroying the instance, giving the engineer time to analyze copies.

IAM roles allow EC2 instances to obtain temporary security credentials automatically through instance profiles, eliminating the need to embed long-term access keys on the instance. These temporary credentials are vended via the instance metadata service and are rotated by AWS STS, reducing the risk of leaked keys and their blast radius. Roles also let you enforce least privilege cleanly, because you can attach narrowly scoped policies to the role and update them without modifying the instance.

Amazon CloudWatch Events (EventBridge) is the correct primary service because GuardDuty natively publishes findings to the EventBridge default event bus as structured events. An EventBridge rule can filter on finding fields (e.g., severity, type, account ID) and route matched findings to targets such as Lambda functions or Step Functions state machines, enabling near-real-time automated remediation without custom polling. This is the standard, serverless integration point for GuardDuty-driven responses.

aws:SourceVpce is the correct condition key because it restricts access to requests that arrive through a specific VPC endpoint, identified by its endpoint ID (e.g., vpce-1234567890abcdef0). This condition is evaluated based on the endpoint's identity, which cannot be spoofed or altered through IP address translation, providing a reliable network-level control. It ensures that only traffic coming from that exact VPC endpoint is allowed to access the S3 bucket.

The bucket policy in Account A grants the IAM user (or Account B) the ability to access the S3 bucket, but cross-account access requires an explicit allow from the requester's own account as well. The IAM user in Account B must have an identity-based policy that permits the specific S3 action (e.g., s3:GetObject) on the target bucket or object ARN. AWS evaluates both the resource-based bucket policy and the identity-based policy, and if either does not explicitly allow the action, the request is denied. Without this IAM policy, the user may have no effective permission to perform the S3 operation despite the bucket policy granting access.

AWS Config is the correct choice because it continuously records configuration changes to your security groups, including additions or deletions of ingress and egress rules. By using managed or custom Config rules, you can define a desired security group configuration (for example, disallowing SSH access from 0.0.0.0/0) and AWS Config will evaluate each change against that baseline, generating compliance alerts and invoking remediation via EventBridge or Lambda when a noncompliant change occurs.

The Resource element is the only policy element that specifies which service resources the action applies to, using Amazon Resource Names (ARNs). To grant an IAM user access to a specific S3 bucket, you must include that bucket's ARN in the Resource field, optionally with a wildcard for objects. Without the correct Resource entry, the policy cannot define the scope of access needed.

For each member account, you enable VPC Flow Logs and set the destination to the central S3 bucket's ARN (e.g., arn:aws:s3:::central-bucket/flowlogs). The central account must attach a bucket policy that grants s3:PutObject to the VPC Flow Logs service principal, typically vpc-flow-logs.amazonaws.com, with a resource condition that limits writes to the source account's AWSLogs prefix. Once configured, flow records are published directly and continuously from each account to the central bucket without any additional credentials or infrastructure, making this the native and correct cross-account delivery mechanism.

When the delivery target for VPC Flow Logs is CloudWatch Logs, the log group is the container that receives and stores the published flow log records. It must exist in the same Region as the monitored VPC, and VPC Flow Logs automatically creates a log stream for each elastic network interface. Without this log group (or permission to create it), you cannot complete CloudWatch Logs delivery.

Multiple successful console sign-ins from the same IAM user in a short window, particularly from different source IP addresses or geographies, is a well-recognized indicator of credential theft. An attacker who has obtained the user's password (and possibly bypassed MFA) will often log in repeatedly to establish persistence, exfiltrate data, or escalate privileges. The correct incident-response action is to treat these events as evidence of compromise, invalidate the credentials immediately, and review CloudTrail for unauthorized actions.

This is the correct architecture: the internet-facing ALB resides in public subnets, where it has public IP addresses and a route through the internet gateway to accept client traffic, while the EC2 instances are placed in private subnets with no public IPs or direct internet ingress. The ALB terminates HTTP/HTTPS traffic and forwards requests to instances over private IP addresses using target groups; security groups on the instances should only allow traffic from the ALB security group. This design keeps instances isolated from direct internet access while still providing high availability across two Availability Zones.

CloudTrail records every API call, capturing the IAM role's identity, source IP, timestamp and requested S3 action. This lets the engineer trace the cross-account calls back to the specific EC2 instance and assess whether the pattern indicates malicious exfiltration.

Setting the 'password expiration period' to 0 in the IAM account password policy causes every existing password to expire immediately, forcing each IAM user to choose a new password at the next sign-in. Because the account-level policy has already defined the required strength, the newly chosen passwords must satisfy those strong-complexity rules. This is the only listed option that enforces the strong-password requirement collectively on all users without requiring manual intervention per user.

aws:ResourceTag allows you to write a condition such as StringEquals: aws:ResourceTag/Project: Dev, which is evaluated against tags attached to the resource that the request targets. This AWS global condition key supports attribute-based access control and works in both identity-based and resource-based policies. It directly enforces that a developer can only perform an action when the specific resource has the required tag key-value pair, making it the correct choice for this requirement.

Creating an organization trail in the management account of an AWS Organization automatically logs events from every member account, including future accounts as they are added. This trail delivers all cloud trail event history to a single S3 bucket you designate, eliminating the need to configure trails individually per account. It gives central administrators full visibility and control over governance, and it supports a single set of lifecycle policies and permissions applied across the entire organization.

This solution combines an explicit bucket policy deny with the s3:x-amz-server-side-encryption condition key to reject any PutObject that does not specify aws:kms as the encryption value, making enforcement happen before the write is committed. Because this is a request-level condition, it cannot be bypassed by client-side SDK settings or explicit SSE headers that differ from KMS. S3 Inventory then provides a periodic CSV or Parquet report of existing objects, including their encryption status, enabling the team to locate and remediate any legacy objects that predate the policy.

This bucket policy is correct because it uses an explicit Deny with a StringNotEquals condition to require that every s3:PutObject request includes the x-amz-server-side-encryption header set to aws:kms. Since explicit Deny statements override any Allow, any upload that lacks the header or uses a different encryption method is blocked, while requests that properly specify SSE-KMS are allowed. The absence of the header also makes StringNotEquals evaluate true, so the Deny also catches requests that omit encryption entirely, ensuring sensitive data is always encrypted with KMS-managed keys.

This is the correct least-privilege policy: it restricts the s3:GetObject action to a specific Resource ARN, arn:aws:s3:::my-bucket/*, which matches only objects inside the my-bucket bucket. The lack of s3:ListBucket permission is fine for direct object retrieval—the caller must know the object key, but that matches the requirement of granting access to the bucket's objects. The policy contains no wildcards beyond the object-name segment (*), so it does not grant access to other buckets or to bucket-level operations like listing. This scoping aligns with AWS's recommended practice of using resource-level permissions for S3 actions and is the only option that satisfies the principle of least privilege.

Applying a new security group that denies all inbound and outbound traffic immediately severs the instance's network path at the hypervisor, cutting off the C2 server connection without killing the process or losing memory artifacts. Because security group changes are applied instantly across the VPC, this containment step is faster than OS-level firewall rules and avoids tipping off the attacker. The instance remains powered on, allowing you to capture a memory dump and disk image for forensic analysis before any restoration or termination.

The most likely cause is that the metric filter is attached to a different log group than the one receiving the CloudTrail CreateAccessKey events. Metric filters evaluate only log data that arrives in the specific log group they are configured on; if the CloudTrail trail streams to another log group in another account or region, or the filter is created under the wrong log group name, the pattern never sees the relevant events. Verify the trail's destination log group and that the filter is assigned there.

When environment variables are set, the AWS SDK prioritizes them over the instance profile credentials. If those credentials are expired or have insufficient permissions, the application will receive access denied errors even though the instance profile role has the correct permissions. The SDK does not fall back to the instance profile when explicit credentials are provided.

IAM Access Analyzer is the correct tool here because it uses automated reasoning to analyze resource-based policies, including S3 bucket policies, and generates findings for any policy that grants access to principals outside your AWS account or organization. It specifically flags 'public' access when a bucket policy allows anonymous access (Principal: "*"), and it also surfaces cross-account access with detailed context about the external principal, actions, and resource. This allows you to review every bucket policy systematically and remediate unintended public exposure, making it a comprehensive policy-review solution.

Adding a bucket policy with a Deny effect and the condition `aws:SecureTransport: false` will reject any request that is not sent over SSL/TLS. This is the most direct and comprehensive way to enforce HTTPS on S3 because the bucket policy is evaluated for every request to the bucket, regardless of which IAM principal, account, or anonymous user makes it. Using a resource-based policy at the bucket level also aligns with AWS best practices for S3 security and is the recommended mechanism to mandate encrypted connections.

A snapshot is a point-in-time, crash-consistent copy of the EBS root volume that preserves the current on-disk state without stopping or detaching the instance. Taking a snapshot is the standard forensic first step because it is non-intrusive, does not trigger shutdown scripts, and keeps the original volume intact for later analysis while the snapshot can be inspected on a separate examination instance.

When a CloudTrail trail is configured to deliver to Kinesis Data Firehose, the logs are sent to a delivered stream that has a default throughput limit of 5,000 records per second and 5 MB per second. If the trail produces records faster than the stream can accept, Firehose throttles the producer, and CloudTrail can drop logs or mark delivery as failed for that interval. This perfectly explains intermittent missing logs, unlike the other options that would cause all-or-nothing or delayed effects.

Amazon Detective is purpose-built for security investigations and natively integrates with GuardDuty findings. It automatically aggregates and correlates data from VPC Flow Logs, CloudTrail, and other sources, presenting a visual graph of resources, IP addresses, and behaviors. By launching an investigation from a GuardDuty finding, you can quickly scope the affected EC2 instances and analyze the associated flow log data without manual querying. This gives the most efficient and complete investigation pathway.

AWS CloudTrail is the correct service because it captures management events as API activity, including all IAM policy changes such as PutRolePolicy, AttachUserPolicy, and CreatePolicyVersion. Each CloudTrail event records the requesting IAM principal, source IP address, event time, and request parameters, providing a complete, tamper-evident audit trail. You can query these events via the CloudTrail console, the LookupEvents API, or deliver them to S3 or CloudWatch Logs for long-term retention and automated alerting.

An IPsec VPN creates an encrypted tunnel between the configured endpoints (here, the instances), typically using ESP in tunnel or transport mode to encrypt IP payloads and, when needed, the original IP header. It also provides mutual authentication, integrity checking, and anti-replay protection, ensuring all traffic between the instances is confidential and tamper-evident. This is the only option that actively encrypts the traffic itself.

AWS CloudTrail records every management API call made through the IAM service, including PutUserPolicy, PutRolePolicy, AttachUserPolicy, and DeleteUserPolicy, as management events. Each event contains the identity of the caller, the source IP address, the request parameters, and a timestamp, giving you a full, tamper-evident audit trail of IAM policy changes. By default, the event history is available for 90 days, and you can configure a trail to deliver events to S3 and CloudWatch Logs for long-term retention and analysis.

Amazon Inspector is integrated with AWS Systems Manager Agent, which is responsible for collecting inventory and system configuration data from EC2 instances for assessment. For an instance to appear as 'Managed,' the SSM Agent must be running and registered with the Systems Manager service. If the agent is not running or not registered, Inspector cannot obtain the necessary telemetry and therefore reports the instance as 'Unmanaged.' This is the correct condition that explains the issue.

Amazon CloudWatch Events (also known as Amazon EventBridge) is the native service that GuardDuty uses to emit findings as events. You create an event rule with a pattern that matches fields like the finding type or severity, and set a Lambda function as the target. This rule can invoke Lambda in near real time whenever a qualifying GuardDuty finding is generated, making it the correct foundational service for automated incident response.

Amazon Athena can query CloudTrail logs stored in S3 by defining a table over the bucket using the CloudTrail SerDe, with columns matching the JSON event structure and partitions for date/hour. The table is either created manually via a DDL statement or automatically by the 'Create Athena table' option in the CloudTrail console. Athena then runs standard SQL directly on the compressed log objects without moving or transforming the data, making it the simplest serverless way to search all API calls.

An IAM role attached to the instance profile supplies temporary, automatically rotated credentials to the EC2 instance, avoiding long-term access keys on the instance. This satisfies the requirement for read-only S3 access using the most secure mechanism.

The SCP uses a condition such as ec2:InstanceType StringNotEquals t2.micro,t2.small. For an m5.large launch, the condition evaluates to true because m5.large is not in the allowed list, so the Deny statement applies and the RunInstances call is explicitly denied. The launch fails because the requested instance type does not match the only two approved types, regardless of any IAM policy that might allow it.

The correct cross-account configuration requires two resource-based policies that address separate authorization layers: the bucket policy must explicitly allow the external account's principal to call s3:GetObject on the object, and the KMS key policy must explicitly allow that same external principal to call kms:Decrypt. The bucket policy authorizes the S3 data-plane operation, while the KMS key policy authorizes the cryptographic operation that S3 performs on the requester's behalf. Without either policy, the request fails because the external account is not part of the key owner's account and cross-account access is denied by default.

AWS Security Hub is the correct choice because it provides a centralized view of security and compliance posture across AWS accounts. It ingests and aggregates findings from AWS Config, including IAM role compliance checks, and continuously runs controls from frameworks like CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices. This allows a security engineer to create a governance framework that monitors IAM roles against least-privilege policies, with automated compliance reporting and a unified dashboard. Security Hub also integrates with AWS Organizations to aggregate findings from multiple accounts, making it the appropriate service for enterprise-wide IAM governance.

CloudTrail in account B, the bucket owner account, is the authoritative audit trail for S3 API calls made against the bucket. When you enable CloudTrail with S3 data events for the bucket, every cross-account request from account A generates an event that includes the full userIdentity ARN of the calling IAM user or role. The event record also contains the source IP address, the event name (e.g., GetObject), and the bucket ARN, allowing you to trace exactly which IAM identity performed the suspected exfiltration. This is the only option that gives you the complete identity-level detail required for the investigation.

AWS WAF evaluates rules in ascending priority order, where lower numeric priority values are evaluated first. If a higher-priority allow rule (e.g., priority 0) matches all requests and is set to 'Allow', the web ACL immediately stops evaluating remaining rules, so a lower-priority block rule (e.g., priority 1) is never reached. The presence of such a broad allow rule fully explains why requests are not blocked, even when the block rule itself is properly configured.

Launching an EC2 instance requires more than the `ec2:RunInstances` action; the policy must also allow dependent resources. The `RunInstances` call authorises each referenced AMI, security group, subnet and key pair, so a policy granting only the run action fails with `AccessDenied` when those resource-level permissions are absent.

PKCS#11 sessions on a CloudHSM are finite, and each session handle is valid only until C_CloseSession or C_Finalize is called. An application that fails to close sessions leaks them, and once the HSM client's session limit is reached, any handle retained from an evicted or expired session returns CKR_SESSION_HANDLE_INVALID on subsequent operations. This is the correct explanation: the root cause is session lifecycle mismanagement, not network or identity configuration, and the fix is to use try-with-resources or a session pool that guarantees C_CloseSession in all code paths.

Detaching the AdministratorAccess policy from the 'admin' user directly removes the administrative privilege, while attaching a custom read-only policy grants only the permissions needed for the user's job — a least-privilege approach. The user keeps its IAM identity, credentials, MFA, and other configuration, making this the minimal, reversible change. This should be combined with a review of the custom policy's actions and resources to ensure it truly limits access to read-only APIs.

VPC Traffic Mirroring copies live traffic from Elastic Network Interfaces and forwards it to a chosen monitoring appliance or security tool, such as a customer-managed NGFW or packet analyzer, using VXLAN-encapsulated tunnels. It captures full packet content, including headers and payload, without requiring any software installation on the source instance and without impacting the production traffic path. This makes it the correct choice for deep packet inspection and forensic analysis of network traffic.

AWS Config records resource configuration changes and can evaluate those changes against rules that define desired configurations. A custom rule implemented as a Lambda function returns a compliance status based on a configuration item, and AWS Config can publish the result to an SNS topic when a resource becomes noncompliant. This combination enables real-time notification and corrective workflow each time a configuration change occurs, which is exactly what the requirement needs.

Create an IAM role with a policy allowing s3:GetObject on the specific bucket and object ARNs, then set that role as the Lambda function's execution role. The role's trust policy must allow lambda.amazonaws.com to assume it, after which Lambda calls STS to receive temporary credentials scoped to that role. These credentials are automatically rotated and passed to the AWS SDK, making this the least-privilege, auditable way to grant the function read access to S3.

Cross-account IAM roles allow the auditor to assume a role in the production account without creating local IAM users. Attaching only Config read actions enforces least privilege, and the trust policy scopes access to the auditor's account. This meets the no-local-users requirement while limiting permissions to compliance data retrieval only, which is exactly what the scenario asks for.

aws:MultiFactorAuthPresent is the correct global condition key because it is a Boolean request context key that indicates whether the principal authenticated with an MFA device. By adding a condition such as "Bool": {"aws:MultiFactorAuthPresent": "true"} to an IAM policy, administrators can require every matching request to come from a session that has completed MFA. This directly enforces the organization's MFA requirement and cannot be substituted by IP, client, or time-based checks.

AWS CloudTrail is the correct answer because it is the only service that records API activity as data events for S3, and by default (when data events are enabled) it captures the exact IAM user principal, source IP address, user agent, request parameters, and timestamp for actions like GetObject and PutObject. This enables the security engineer to create a complete audit trail of who accessed a specific S3 object and when, which is precisely what is needed in a breach investigation. CloudTrail also integrates with CloudWatch Logs for alerting and can deliver to a separate S3 bucket or a security data lake, but its core value here is the user-level accountability it provides for object-level operations.