SCS-C02 Practice Questions

Question 1

The exhibit shows an SCP attached to an organizational unit. What is the effect of this policy?

Accepted Answer

It allows s3:PutBucketPolicy only if the bucket ACL is set to bucket-owner-full-control.. The SCP denies s3:PutBucketPolicy only when the bucket ACL is not set to 'bucket-owner-full-control'. If the ACL is set to that value, the action is allowed. Thus, it ensures that when a bucket policy is created, the ACL must grant full control to the bucket owner. It does not deny all PutBucketPolicy actions.

Answer

It denies all s3:PutBucketPolicy actions on all buckets.

Answer

It denies s3:PutBucketPolicy for any bucket that does not have an ACL.

Answer

It allows s3:PutBucketPolicy for buckets owned by the management account.

Question 2

A security engineer finds this IAM policy attached to a user. The user is able to create CloudTrail trails but cannot start logging. What is the MOST likely reason?

Accepted Answer

The user lacks `iam:PassRole` permission for the CloudTrail service role.. The user can create CloudTrail trails but cannot start logging because starting logging requires the `iam:PassRole` permission to pass the CloudTrail service role to the CloudTrail service. Without this permission, CloudTrail cannot assume the role needed to write logs to the S3 bucket and deliver them to CloudWatch Logs, even though the user has `cloudtrail:CreateTrail` and `cloudtrail:StartLogging` actions in the policy.

Answer

The `StartLogging` action is not listed in the policy.

Answer

The policy does not specify the `cloudtrail:StartLogging` action.

Answer

The user does not have permission to create CloudTrail trails.

Question 3

Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)

Accepted Answer

Enable DNS query logging and publish to CloudWatch Logs.. Amazon GuardDuty relies on DNS query logs to detect suspicious domain name resolution patterns, such as DNS tunneling or communication with known malicious domains. By enabling DNS query logging and publishing to CloudWatch Logs, GuardDuty can ingest this data as a source for its threat detection algorithms. Without DNS logs, GuardDuty cannot analyze DNS-based attack vectors within the VPC.

Answer

Enable CloudTrail data events for S3.

Answer

Enable S3 server access logs.

Answer

Enable AWS Config configuration history.

Question 4

A security engineer is reviewing the CloudTrail configuration for a trail named 'management-trail'. The engineer needs to ensure that all S3 object-level operations in the bucket 'my-bucket' are logged. What is the issue with the current configuration?

Accepted Answer

The 'Values' field should end with a '/*' to capture all objects under the prefix.. The 'DataResources' value should include a trailing '/*' to indicate all objects under the prefix. Option A is incorrect because the ReadWriteType is 'All', which covers both read and write. Option C is incorrect because the event selector includes management events. Option D is incorrect because the trail is not necessarily multi-region from this output.

Answer

The ReadWriteType is set to 'All', which does not include write events.

Answer

The IncludeManagementEvents should be set to false to focus on data events.

Answer

The trail should be configured as a multi-region trail to capture all regions.

Question 5

Refer to the exhibit. A security engineer runs the 'simulate-custom-policy' command to test a policy. The output shows 'explicitDeny' for ec2:RunInstances. What is the most likely reason?

Accepted Answer

The policy includes an explicit Deny statement for ec2:RunInstances. The 'simulate-custom-policy' output shows 'explicitDeny', which indicates that the policy contains an explicit Deny statement for the action ec2:RunInstances. An explicitDeny is only returned when a Deny statement matches the action, not when the action is simply missing from an Allow list. Therefore, the most likely reason is that the policy includes an explicit Deny statement.

Answer

The policy does not include ec2:RunInstances in the Action list

Answer

The policy allows ec2:Describe* but the action ec2:RunInstances is not a Describe action

Answer

The policy uses a Resource of '*' which does not include the required resources

Question 6

A company uses Amazon S3 to store sensitive documents. They must ensure that all objects are encrypted at rest and that any attempt to upload an unencrypted object is denied. Which S3 bucket policy statement achieves this?

Accepted Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256 AND the encryption is SSE-S3.. Option C is correct because it explicitly denies PutObject unless the request includes both the x-amz-server-side-encryption header with value AES256 (which requests SSE-S3) and the encryption type is SSE-S3. This ensures only objects encrypted with SSE-S3 can be uploaded. Option A is incorrect because it only checks for the header value AES256; while AES256 is specific to SSE-S3 and would also enforce SSE-S3, Option C provides a more explicit condition. Option B is incorrect because it denies all PutObject requests. Option D is incorrect because an Allow statement cannot enforce a denial; a Deny statement is required to block unencrypted uploads.

Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption: AES256.

Answer

Deny s3:PutObject for all principals.

Answer

Allow s3:PutObject only when x-amz-server-side-encryption: AES256 is present.

Question 7

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The security team requires that all traffic between the ALB and EC2 instances be encrypted. Which configuration ensures this requirement is met?

Accepted Answer

Use an HTTPS listener on the ALB and configure the target group with HTTPS.. It ensures end-to-end encryption between the ALB and EC2 instances. By configuring an HTTPS listener on the ALB, traffic from clients to the ALB is encrypted. Then, by setting the target group protocol to HTTPS, the ALB re-encrypts the traffic before forwarding it to the EC2 instances, fulfilling the security team's requirement that all traffic between the ALB and EC2 instances be encrypted.

Answer

Use a TCP listener on the ALB and a TCP target group.

Answer

Configure security group inbound rules to allow only HTTPS traffic.

Answer

Use an HTTP listener on the ALB and HTTP on the target group.

Question 8

A company uses Amazon RDS for PostgreSQL with encryption at rest enabled using AWS KMS. The security team wants to ensure that database backups (automated snapshots) are also encrypted and that the encryption key can be rotated on demand without re-encrypting the data. Which approach should be taken?

Accepted Answer

Create a new KMS key and modify the RDS instance to use the new key. The existing backup will be re-encrypted with the new key when the instance is modified.. You can create a new KMS key and modify the RDS instance to use the new key. This action re-encrypts the database and its automated snapshots with the new key, providing on-demand key rotation. The re-encryption is performed automatically during the modification. Option A is incorrect because RDS does not allow specifying a separate KMS key for backups; backups use the same key as the instance. Option B is incorrect because disabling the old KMS key would break access to existing backups that are still encrypted with that key. Option C is incorrect because automatic key rotation in KMS does not trigger re-encryption of existing data; it only generates new key material for future encryption operations.

Answer

Use a separate KMS key for backups by enabling 'Copy tags to snapshots' and specifying a different key.

Answer

Disable the old KMS key and enable a new KMS key for the RDS instance. The old backup will remain encrypted with the old key.

Answer

Enable automatic key rotation in KMS and import new key material every 90 days.

Question 9

Refer to the exhibit. A security engineer deploys this CloudFormation template. An IAM role 'DataAccessRole' in the same account needs to read objects from the bucket. After deployment, users assume the role but get AccessDenied errors when trying to read objects. What is the MOST likely cause?

Accepted Answer

The PublicAccessBlockConfiguration is blocking the bucket policy.. The PublicAccessBlockConfiguration at the account or bucket level overrides any bucket policy that grants public or cross-account access. Even though the bucket policy may allow the DataAccessRole to read objects, the PublicAccessBlockConfiguration blocks all public or cross-account access, causing AccessDenied errors. This is the most likely cause because the bucket policy is effectively ignored when public access blocks are enabled.

Answer

The IAM role is not attached to the EC2 instance profile.

Answer

The bucket is encrypted with SSE-KMS and the role lacks KMS permissions.

Answer

The role does not have s3:ListBucket permission.

Question 10

Refer to the exhibit. A user from IP 10.1.2.3 attempts to download an object from my-secret-bucket using HTTP (not HTTPS). What will be the outcome?

Accepted Answer

Failure, because the Deny statement blocks HTTP requests.. The Deny statement with condition aws:SecureTransport=false will block HTTP requests. Even though the IP matches the allow rule, the explicit Deny overrides the Allow.

Answer

Success, because the Allow statement is evaluated first.

Answer

Failure, because the user's IP is not in the allowed range.

Answer

Success, because the user's IP is within the allowed range.

Question 11

A company stores data in Amazon S3 and uses AWS KMS with Customer Master Keys (CMKs) for encryption. The security team wants to audit when the CMK is used to decrypt data. Which of the following will provide this information?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS Decrypt API calls, which is exactly what is needed to audit CMK decryption. Option A (AWS Config) records configuration changes, not API calls. Option B (Amazon CloudWatch Logs) can store logs but does not generate the KMS decrypt logs itself; CloudTrail generates them. Option D (S3 server access logs) record requests to S3 objects, not the KMS decryption calls that happen when accessing encrypted objects.

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Answer

S3 server access logs

Question 12

A security engineer is configuring AWS Config to track changes to security groups in a VPC. The engineer wants to be notified when a security group is modified. Which TWO steps are required to achieve this?

Accepted Answer

Configure an SNS topic and subscribe to it to receive notifications when the Config rule triggers.. Options A and D are correct. To monitor security group changes with AWS Config, you need to create an AWS Config rule (option D) that tracks changes to security groups. To receive notifications when the rule triggers, you configure an SNS topic and subscribe to it (option A). Option B is incorrect because AWS CloudTrail logs API calls to security groups, but Config itself monitors resource configuration changes without requiring CloudTrail. Option C is incorrect because Amazon GuardDuty is a threat detection service, not a configuration change monitor. Option E is incorrect because VPC Flow Logs capture network traffic, not configuration changes. The common pitfall is assuming CloudTrail or GuardDuty is necessary, but Config's built-in change tracking suffices.

Answer

Enable AWS CloudTrail to log security group changes.

Answer

Enable Amazon GuardDuty to detect security group modifications.

Answer

Enable VPC Flow Logs to capture security group activity.

Question 13

A company is using AWS KMS to encrypt data at rest. The security team needs to ensure that keys cannot be deleted before a retention period. Which THREE steps should be taken? (Choose three.)

Accepted Answer

Enable AWS CloudTrail to log key deletion events.. Options A, B, and E are correct. Enabling CloudTrail to log key deletion events helps audit attempts. Setting CloudWatch alarms on kms:ScheduleKeyDeletion events provides notification. Scheduling key deletion with a waiting period (e.g., 7 days) implements a retention period. Option C is incorrect because IAM policies can prevent deletion but do not enforce a retention period; the question asks to ensure keys cannot be deleted before a retention period, which requires a waiting period, not just denial. Option D is incorrect because automatic rotation does not prevent deletion.

Answer

Create an IAM policy that denies kms:ScheduleKeyDeletion.

Answer

Enable automatic key rotation.

Question 14

A company uses AWS KMS to encrypt objects in an S3 bucket. The security team wants to ensure that only users with the appropriate KMS key permissions can decrypt objects. Which TWO conditions should be included in the S3 bucket policy to enforce this? (Choose TWO.)

Accepted Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}. Options A and E are the only distinct conditions that can be used in an S3 bucket policy to enforce that only users with appropriate KMS key permissions can decrypt objects. kms:ViaService restricts the use of the KMS key to requests coming via the S3 service, and kms:EncryptionContext restricts decryption to requests that include the specific S3 bucket ARN. Option C is identical to A and thus does not provide an additional constraint, making it redundant. Options B and D are not valid condition keys for S3 bucket policies.

Answer

"Condition": {"StringEquals": {"kms:KeySpec": "SYMMETRIC_DEFAULT"}}

Answer

"Condition": {"StringEquals": {"kms:ViaService": "s3.us-east-1.amazonaws.com"}}

Answer

"Condition": {"StringEquals": {"kms:GranteePrincipal": "arn:aws:iam::123456789012:role/Admin"}}

Question 15

A company has a requirement to block traffic from specific IP addresses known to be malicious. The company has an Application Load Balancer (ALB) that fronts a web application. The security engineer needs to implement a solution that can block these IP addresses at the edge before they reach the ALB. Which AWS service should be used?

Accepted Answer

Use AWS WAF with an IP set rule to block the malicious IP addresses.. AWS WAF can be associated with an Application Load Balancer and allows you to block traffic based on IP addresses using IP set rules. This enables blocking at the edge before traffic reaches the ALB. Option A is incorrect because security groups are instance-level firewalls and cannot be attached to an ALB. Option B is incorrect as AWS Shield Advanced provides DDoS protection but does not support IP-based blocking by itself. Option C is incorrect because network ACLs operate at the subnet level, not at the ALB level, and cannot block traffic specifically destined for the ALB.

Answer

Configure security groups on the ALB to deny traffic from those IP addresses.

Answer

Enable AWS Shield Advanced and configure rate-based rules.

Answer

Add a network ACL rule to the ALB's subnet to deny the IP addresses.

AWS Certified Security Specialty SCS-C02 practice test

Three ways to study

Study SCS-C02 by domain

Study SCS-C02 by topic

Threat Detection and Incident Response practice questions

Security Logging and Monitoring practice questions

Identity and Access Management practice questions

Management and Security Governance practice questions

Infrastructure Security practice questions

Data Protection practice questions

SCS-C02 fundamentals practice questions

SCS-C02 scenario practice questions

SCS-C02 troubleshooting practice questions

Top SCS-C02 questions

AWS Certified Security Specialty SCS-C02 practice questions

How to use these SCS-C02 questions

Quick answer