AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 376–450

Option D is correct. The bucket policy must also grant the s3:GetBucketAcl permission to allow CloudTrail to verify the bucket's ACL. Without it, CloudTrail will fail.

Option A is wrong because the ARN is correct. Option B is wrong because the Action is correct. Option C is wrong because the Principal is correct.

Options A and D are correct. Option A is correct because a NAT gateway in a public subnet allows outbound internet for private instances without inbound access. Option D is correct because a security group on the RDS database allows fine-grained control.

Option B is wrong because an internet gateway in a private subnet would expose instances. Option C is wrong because a public subnet allows direct internet access. Option E is wrong because a single subnet defeats isolation.

Option D is correct because taking a snapshot of the volume before deletion, encrypting it with a different KMS key, and then deleting the volume ensures the data is retained for 90 days and the original volume is unrecoverable. Option A is wrong because disabling the key does not prevent data recovery if a snapshot exists. Option B is wrong because lifecycle manager does not handle deletion.

Option C is wrong because it does not preserve data.

Option B is correct because it uses the aws:SecureTransport condition to enforce HTTPS. Option A is wrong because it enforces server-side encryption, not transit. Option C is wrong because aws:SourceIp restricts IP addresses.

Option D is wrong because it refers to a VPC endpoint condition.

Options B, C, and D are correct. Amazon GuardDuty continuously monitors for malicious activity. AWS CloudTrail logs API calls for investigation.

AWS Config tracks configuration changes that may indicate security issues. Option A is wrong because VPC Flow Logs are for network traffic analysis, not detection of all incidents. Option E is wrong because Amazon Inspector is for vulnerability assessment, not incident detection.

CloudTrail logs API calls, including RunInstances, which contains the AMI ID. Option A is wrong because VPC Flow Logs do not contain instance metadata. Option B is wrong because CloudWatch Logs does not capture EC2 launch events by default.

Option D is wrong because AWS Config records resource configurations but not the API call details.

Option A is correct because you cannot enable encryption on an existing RDS instance; you must create a new encrypted instance and migrate. Option B is wrong because you cannot modify the existing instance to add encryption. Option C is wrong because snapshots can be encrypted, but you still need to restore to a new instance.

Option D is wrong because you cannot attach encrypted storage.

Option A is correct because SCPs can restrict actions at the account level. Option B is wrong because IAM policies apply to users/roles, not accounts. Option C is wrong because resource-based policies apply to specific resources.

Option D is wrong because service control policies are the correct mechanism, not IAM permissions boundaries.

Enable key rotation and set a deletion window. Option A is wrong because disabling the key does not prevent deletion. Option B is wrong because the deletion window is not automatically set.

Option D is wrong because the key policy cannot prevent deletion.

Option D is correct. The first statement denies PutObject if the encryption header is not "aws:kms". Since the header is "AES256", it does not equal "aws:kms", so the condition StringNotEquals is true, resulting in a deny.

The second statement denies if the header is null; here it is not null, so the second statement does not apply. Thus, the request is denied.

Option D is correct because an IAM role assigned to the EC2 instance is the best practice. Option A is wrong because access keys stored on the instance are less secure. Option B is wrong because a bucket policy with a principal of the instance ID is not possible; bucket policies use IAM principals.

Option C is wrong because security groups do not grant access to S3.

Option B is correct because the policy allows the SecurityAudit role to decrypt and re-encrypt only from the same account. Option A is wrong because it does allow decrypt and re-encrypt. Option C is wrong because the condition restricts to the same account.

Option D is wrong because the policy doesn't restrict key usage to specific resources.

SSL/TLS encrypts data in transit between client and database. Option B is wrong because encryption at rest does not protect data in transit. Option C is wrong because VPN provides encryption but is overkill for direct connect.

Option D is wrong because client-side encryption would require application changes.

Option B is correct because referencing the ALB's security group as the source allows inbound traffic only from the ALB. Option A allows all HTTP traffic. Option C uses the VPC CIDR, which is too broad.

Option D uses the ALB's public IP, which is not static and not recommended.

Option D is correct because Object Lock with Governance mode prevents deletion, and lifecycle policies can expire objects after 7 years. Option A only prevents deletion, not overwriting. Option B only protects against accidental deletion.

Option C only manages storage classes.

Options B and D are correct. Server-side encryption (SSE-S3, SSE-KMS, SSE-C) and S3 Block Public Access are both methods to secure data at rest. Option A is wrong because bucket policies control access but do not encrypt data.

Option C is wrong because versioning helps with data recovery, not encryption. Option E is wrong because MFA Delete adds protection for deletion, not encryption.

Option D is correct because Transit Gateway supports appliance mode on attachments, which enables asymmetric routing for inspection. Option A is wrong because VPC Peering does not support central inspection. Option B is wrong because placing the appliance in a public subnet is not secure and does not leverage Transit Gateway.

Option C is wrong because route tables alone do not force traffic to the appliance if asymmetric routing is not handled.

Option C is correct because the trusting account (role owner) must have a trust policy allowing the external account, and the external account must have a policy granting users permission to assume the role. Option A is wrong because only the trusting account needs trust policy. Option B is wrong because only the external account needs to grant sts:AssumeRole.

Option D is wrong because neither account needs password policy.

Option C is correct because it explicitly allows s3:PutObject on the target bucket and denies all other S3 actions. Option A is wrong because it only allows s3:PutObject but does not deny other actions, so other S3 actions would still be allowed if the user has another policy granting them. Option B is wrong because it allows all S3 actions on the bucket, which is too broad.

Option D is wrong because it denies all S3 actions except PutObject, but the Deny effect with NotAction can be confusing; however, the more straightforward approach is Option C.

Option C is correct because creating access keys allows programmatic access, and creating users allows creation of new identities. Option A is incorrect because it does not directly affect logging. Option B is incorrect because it does not directly affect encryption.

Option D is incorrect because it does not directly affect network traffic.

NAT Gateway's security group must allow inbound HTTPS from the private subnet CIDR. The problem statement says it does, so that is not the issue. The most likely issue is that the NAT Gateway's security group must also allow outbound HTTPS to 0.0.0.0/0 for the return traffic.

Option D is correct. Option A is wrong because NACL is stateless but default NACL allows all. Option B is wrong because the security group allows outbound.

Option C is wrong because the route is present.

Using a KMS key policy with a condition on kms:CallerArn is the most effective. Option A is wrong because the key policy already exists and you cannot remove the default key policy. Option B is wrong because the original key policy may have allowed broad access.

Option D is wrong because S3 bucket policy does not control KMS key usage.

Option D is correct. Using an AWS Network Firewall or a third-party firewall appliance allows stateful inspection of traffic and can filter by domain name. Option A (security group egress rules) cannot filter by domain name.

Option B (NACL) is stateless and cannot inspect domain names. Option C (VPC endpoint for S3) is for S3, not general HTTPS.

Option C is correct because S3 endpoints are accessed via a prefix list in route tables; without a VPC Gateway Endpoint for S3, traffic goes through a NAT Gateway or Internet Gateway, but the private subnet lacks a route to the internet. Option A is wrong because S3 supports HTTPS without TLS termination. Option B is wrong because S3 is a global service and does not require a specific region endpoint configuration at the VPC level.

Option D is wrong because S3 does not require an IAM role for connectivity; that is for access permissions.

Option A is correct because the instance profile is created, the IAM role is attached, and the EC2 instance is launched with that profile. Option B is wrong because the role itself is not attached directly to the instance; the instance profile must be used. Option C is wrong because storing credentials on the instance is insecure.

Option D is wrong because the instance profile is not just for the root user; the role is assumed automatically.

Option A is correct because CloudTrail logs API calls and can be configured to store logs for 90 days. Option B is wrong because CloudWatch Logs is for application logs, not API calls. Option C is wrong because S3 is storage, not an auditing service.

Option D is wrong because Config is for resource configuration changes, not API calls.

Option B is correct. The Deny statement with condition aws:SecureTransport false blocks requests that are not using HTTPS. If the CLI is not configured to use HTTPS, the request will be denied.

Option A is wrong because the user has s3:PutObject permission. Option C is wrong because there is no encryption requirement. Option D is wrong because there is no bucket policy blocking.

Option E is wrong because the user has permission to upload.

Option A and Option D are correct. The database subnets should not have a route to the Internet Gateway, and their security group should only allow traffic from the web servers' security group. Option B is unnecessary; network ACLs are stateless and can be used, but security groups are sufficient.

Option C is incorrect because assigning public IPs would expose them. Option E is incorrect because a NAT gateway is for outbound internet access, not inbound.

Option C is correct because the bucket policy must also grant the s3:GetBucketAcl action for CloudTrail to verify the bucket ACL. Option A is wrong because encryption is not required. Option B is wrong because the region is not specified in the policy.

Option D is wrong because the resource ARN is correct for CloudTrail logs.

Option A is correct because a service control policy (SCP) can be applied at the organizational level to deny actions that modify S3 public access settings. Option B is incorrect because IAM policies apply to users/roles, not accounts. Option C is incorrect because bucket policies are per-bucket, not organizational.

Option D is incorrect because CloudFormation StackSets deploy resources, not enforce policies.

Option B is correct because the policy denies all S3 actions when the request is not using HTTPS (SecureTransport false). Option A is wrong because it denies only non-HTTPS. Option C is wrong because it does not allow anything.

Option D is wrong because it does not require MFA.

Security groups are stateful; you can allow inbound traffic from the security group of the application server. Option A is correct. Option B is less secure because it allows all traffic from the subnet.

Option C is incorrect because it allows all traffic from the VPC. Option D is incorrect because it allows traffic from the internet.

CloudWatch Logs can monitor CloudTrail logs for root account usage. A metric filter and alarm can be set up. GuardDuty has a finding for root usage but the requirement is to create a custom alarm.

Config evaluates resources.

Option A is correct because encrypting logs at rest protects confidentiality. Option C is correct because enabling log file integrity validation ensures tamper detection. Option D is correct because limiting access to the S3 bucket using bucket policies ensures only authorized principals can access logs.

Option B is incorrect because CloudTrail logs should be retained for at least one year, not 30 days. Option E is incorrect because CloudTrail does not support cross-region delivery to a single bucket automatically without additional configuration.

Using an IAM policy with a condition that checks the IAM instance profile ARN against a list of approved profiles will enforce both requirements. Option B is wrong because it only requires a role, not an approved one. Option C is wrong because AWS Config can detect but not prevent.

Option D is wrong because SCPs cannot enforce specific instance profile ARNs because they apply at the account level and cannot reference resource-level conditions like ec2:InstanceProfile.

The correct answer is C. By updating the organization trail's event selectors to include S3 data events, CloudTrail will automatically apply this configuration to all accounts in the organization, including future accounts. Option A is incorrect because member accounts cannot modify an organization trail.

Option B is incorrect because creating a new trail in each account is inefficient and does not leverage the organization trail. Option D is incorrect because S3 server access logs are a different feature and do not capture data events via CloudTrail.

Option A is correct because CloudWatch Alarms can monitor any CloudWatch metric and trigger actions when a threshold is breached. Option B is wrong because AWS CloudTrail logs API calls. Option C is wrong because AWS Config monitors configuration changes.

Option D is wrong because Amazon Inspector is a vulnerability assessment service.

Option C is correct because CloudTrail can be configured to use SSE-KMS for encryption, and S3 server access logs can log access to the log files. Option A is wrong because SSE-S3 does not provide access logging. Option B is wrong because SSE-C is not supported by CloudTrail.

Option D is wrong because CloudWatch Logs does not encrypt log files at rest by default.

AWS managed keys are automatically rotated annually. Customer managed keys can have automatic rotation enabled, but the question implies a managed solution. Option B is correct.

Option A is incorrect because customer managed keys require enabling automatic rotation. Option C is incorrect because imported keys do not support automatic rotation. Option D is incorrect because the default EBS encryption uses an AWS managed key, but the question asks for the key type.

Options A, B, and D are correct. To grant read-only access, the policy must allow s3:ListBucket on the bucket resource and s3:GetObject on the object resources. Option C is wrong because s3:PutObject is write access.

Option E is wrong because s3:DeleteObject is not needed for read-only.

Option D is correct. SSH should be restricted to specific IPs (e.g., corporate network) to prevent unauthorized access. Option A is unnecessary if the rules already exist.

Option B would break functionality. Option C is not sufficient; SSH should be restricted.

Option B is correct because Route 53 Resolver query logs can log DNS queries made by resources within a VPC and can be exported to S3. Option A is wrong because VPC Flow Logs capture IP traffic, not DNS queries. Option C is wrong because CloudWatch Logs can capture logs but not directly from Route 53 Resolver without additional configuration.

Option D is wrong because AWS CloudTrail does not log DNS query content.

Option B is correct because AWS KMS with a customer-managed key provides encryption at rest and integrates with AWS CloudTrail to log every use of the key. Option A is wrong because SSE-S3 uses Amazon-managed keys; no customer control or audit. Option C is wrong because SSE-C does not provide key usage auditing.

Option D is wrong because CloudHSM can be used but requires more effort for audit; KMS is simpler.

Option D is correct because the trust policy in Account B must allow Account A, and the user in Account A must have sts:AssumeRole permission. Option A is wrong because an SCP in Account A might allow it. Option B is wrong because MFA is not required.

Option C is wrong because the role exists.

Option C is correct because AWS KMS with customer-managed keys (CMK) allows automatic key rotation every 90 days (or yearly if managed by KMS). Option A is wrong because SSE-S3 uses Amazon-managed keys with automatic rotation of 90 days, but the keys are not customer-provided. Option B is wrong because SSE-C requires customers to provide keys but does not offer automatic rotation.

Option D is wrong because CloudHSM requires manual key rotation.

AWS CloudTrail records API calls for auditing. Option A is wrong because AWS Config tracks resource configuration changes. Option B is wrong because Amazon Inspector assesses vulnerabilities.

Option D is wrong because Amazon GuardDuty detects threats.

Option A is correct because a network ACL at the subnet level blocks all traffic to port 22 from the internet before it reaches instances. Option B is wrong because you cannot deny rules in security groups; you can only allow. Option C is wrong because NACLs are stateless and require explicit outbound rules; however, the question asks to block inbound SSH, which a NACL can do.

Option D is wrong because security groups are not applied at the VPC level.

Option D is correct because aws:MultiFactorAuthPresent is the condition key to check MFA status. Option A is wrong because aws:SourceIp checks source IP. Option B is wrong because aws:RequestedRegion checks region.

Option C is wrong because aws:UserAgent checks user agent string.