How many Troubleshooting Scenario Questions questions are on this page?

This page has 14 Troubleshooting Scenario Questions scenario questions for the SCS-C02 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SCS-C02 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified Security Specialty SCS-C02 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise AWS Certified Security Specialty SCS-C02 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SCS-C02

exam code

Amazon Web Services

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket via a VPC endpoint. The bucket policy allows access only from the VPC endpoint. The instance has an IAM role that grants s3:GetObject on the bucket. The EC2 instance receives an AccessDenied error. What is the most likely cause?

A
The IAM role does not have sufficient permissions.
Why wrong: The role grants s3:GetObject, so permissions should be sufficient from IAM side.
B
The bucket policy does not include the aws:SourceVpce condition.
Without this condition, the bucket policy that restricts to VPC endpoint may not match the request, causing AccessDenied.
C
The VPC endpoint policy is blocking the request.
Why wrong: Endpoint policy could block, but the problem statement says bucket policy allows only from VPC endpoint; the endpoint policy might not be the issue.
D
The EC2 instance's security group does not allow outbound traffic to S3.
Why wrong: Security group would cause a timeout, not an AccessDenied error from S3.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

A company has a policy that requires all IAM users to use multi-factor authentication (MFA) to access the AWS Management Console. A user reports that they are unable to sign in even after configuring MFA. What is the most likely cause?

A
The IAM policy explicitly denies console access.
Why wrong: The policy allows console access, but requires MFA.
B
The user is using the root account instead of an IAM user.
Why wrong: Root account also supports MFA.
C
The MFA token has expired.
Why wrong: MFA tokens are generated dynamically and do not expire like passwords.
D
The MFA device is not properly synchronized with AWS.
Time sync issues can cause MFA authentication to fail.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

Refer to the exhibit. A security engineer is troubleshooting why an IAM user (Alice) cannot encrypt data using a KMS key. Alice has full S3 and KMS permissions via an IAM policy. The key policy is shown. Which statement explains the issue?

Exhibit

{
  "Version": "2012-10-17",
  "Id": "KMSKeyPolicy",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow access for Key Administrators",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::123456789012:role/Admin"
        ]
      },
      "Action": [
        "kms:Create*",
        "kms:Put*"
      ],
      "Resource": "*"
    }
  ]
}

A
The key policy is missing a statement to allow the IAM user to use the key via IAM policies
Why wrong: That would require 'kms:ViaService' condition, but here the key policy simply doesn't allow encrypt.
B
The IAM user does not have the kms:Encrypt permission in their IAM policy
Why wrong: Alice has full KMS permissions via IAM, but key policy doesn't enable IAM policies.
C
The key policy does not include the root account principal
Why wrong: Root is included.
D
The key policy does not allow the IAM user to use the key for any action
Only Admin role gets kms:Put* and kms:Create*, not encrypt.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

A security team is troubleshooting an issue where an IAM role assumed by a Lambda function is unable to write logs to CloudWatch Logs. The role has an attached policy that allows logs:CreateLogGroup and logs:PutLogEvents. What is a likely reason for the failure?

A
The trust policy of the role does not include Lambda as a trusted entity.
Without trust policy, Lambda cannot assume the role.
B
The Lambda function is in a VPC without a NAT gateway.
Why wrong: VPC configuration does not affect CloudWatch Logs access if VPC endpoints are configured.
C
The role does not have permission to create network interfaces.
Why wrong: That is for VPC networking, not CloudWatch Logs.
D
The CloudWatch Logs resource policy denies the role.
Why wrong: Resource policy is for cross-account, not same account.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A security engineer is troubleshooting an issue where an IAM role used by an EC2 instance cannot access an S3 bucket, even though the role has an attached policy that grants s3:GetObject on the bucket. The bucket policy does not explicitly deny access. What is the most likely cause?

A
A service control policy (SCP) is denying access
Why wrong: SCPs are not mentioned, and they would deny at the account level.
B
The bucket policy does not grant access to the IAM role
When using an IAM role, the bucket policy must explicitly allow the role, otherwise the implicit denial applies.
C
The IAM policy is attached to the user instead of the role
Why wrong: The role has the policy attached, so that should work.
D
The bucket has an explicit deny in its policy
Why wrong: The question states the bucket policy does not explicitly deny.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

A company has an S3 bucket with a bucket policy that grants access to an IAM role used by an application running on EC2. The application is unable to read objects from the bucket, even though the IAM role has the necessary permissions. What is the most likely cause?

A
The bucket is in a different AWS account.
Why wrong: Cross-account access is possible with proper policies.
B
The bucket policy denies access to the IAM role.
A deny in bucket policy overrides any allow.
C
The bucket policy does not explicitly allow the IAM role.
Why wrong: If role has permissions, bucket policy must also allow.
D
The IAM role has an explicit deny statement.
Why wrong: If the role had explicit deny, it would be a cause, but the question says role has necessary permissions.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

A company uses AWS Secrets Manager to rotate secrets for its RDS database. The rotation fails periodically, and the security team needs to troubleshoot. Which CloudWatch metric should be monitored to detect rotation failures?

A
AWS/KMS: KeyUsage
Why wrong: Shows KMS key usage, not rotation status.
B
AWS/SecretsManager: SecretRotationSucceeded
This metric indicates rotation success or failure.
C
AWS/Lambda: Invocations
Why wrong: May not capture all failure reasons.
D
AWS/RDS: DatabaseConnections
Why wrong: Does not reflect rotation status.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

Refer to the exhibit. A security engineer is troubleshooting a decryption failure. The command uses the AWS CLI to decrypt a file. The decryption fails with an 'AccessDeniedException' error. The IAM user has the following policy attached:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "*"
    }
  ]
}

What is the most likely cause of the failure?

Network Topology

A
The KMS key policy does not grant the IAM user decrypt permission
Key policies can restrict access even if IAM allows.
B
The IAM user does not have permission to call kms:Decrypt on the specific key
Why wrong: The IAM policy allows Decrypt on all keys.
C
The ciphertext blob is not valid
Why wrong: An invalid ciphertext would produce a different error.
D
The IAM user is not authorized to use the AWS CLI
Why wrong: The error is AccessDenied, not authorization to use CLI.

Full breakdown with real-world context →

Question 9hardmultiple choice

Full question →

A security engineer runs the above CloudTrail lookup command to investigate a change to the S3 bucket policy. The command only returns one event, but the engineer knows that the bucket policy was changed multiple times. What is the most likely reason?

Network Topology

A
The bucket policy changes were made through the AWS Management Console, which is not logged.
Why wrong: Console actions are logged.
B
The event is not logged because PutBucketPolicy is not supported by CloudTrail.
Why wrong: PutBucketPolicy is supported.
C
The command is filtering by the wrong attribute.
Why wrong: Attribute is correct.
D
The command is limiting results to one event.
Max results parameter limits output.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

A security engineer is troubleshooting an issue where CloudTrail logs for a single AWS account are not being delivered to the centralized S3 bucket in the logging account. The engineer has verified that the CloudTrail trail is enabled, the S3 bucket policy allows CloudTrail to write, and the bucket exists. However, no log files have been delivered for the past 6 hours. The engineer checks the CloudTrail console and sees that the trail status shows 'Logging' but the latest log file time is from 8 hours ago. The engineer suspects a permission issue but cannot find any explicit deny in the bucket policy. What is the MOST likely cause of this issue?

A
The CloudTrail trail is not configured to deliver to a cross-account bucket.
Why wrong: CloudTrail supports cross-account delivery with proper bucket policies.
B
The CloudTrail trail is configured with a role that does not have S3 full access.
Why wrong: CloudTrail does not require S3 full access; write permission is sufficient.
C
The S3 bucket is in a different region than the CloudTrail trail.
Why wrong: CloudTrail can deliver to a bucket in any region.
D
The KMS key policy used by the S3 bucket does not grant CloudTrail permission to use the key.
CloudTrail needs kms:Decrypt permission on the KMS key to write to SSE-KMS encrypted buckets.

Full breakdown with real-world context →

Question 11hardmultiple choice

Full question →

A security engineer is troubleshooting an issue where an IAM user cannot assume a role in another AWS account. The trust policy of the role allows the user's account to assume the role, and the user has a policy that allows sts:AssumeRole. The user receives an error: 'Access denied: User is not authorized to perform sts:AssumeRole.' What is the MOST likely cause?

A
The user's policy does not specify the resource ARN of the role.
The policy must have a Resource element matching the role ARN.
B
The role requires an external ID that the user did not provide.
Why wrong: External ID is optional unless the trust policy requires it.
C
The user must use multi-factor authentication (MFA).
Why wrong: MFA is not required unless the policy specifies it.
D
The trust policy does not include the user's IAM user ARN.
Why wrong: Trust policy can allow the entire account.

Full breakdown with real-world context →

Question 12hardmultiple choice

Full question →

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role has an attached policy that grants s3:GetObject on the bucket. However, the application on the EC2 instance is unable to read objects. What is the MOST likely cause?

A
The S3 bucket policy denies access to the IAM role.
Why wrong: Could be a cause, but the bucket policy is not mentioned as denying access.
B
The EC2 instance does not have an IAM instance profile configured.
Without an instance profile, the role credentials are not available to the instance.
C
The policy is attached to the EC2 instance instead of the role.
Why wrong: Policies can only be attached to IAM identities, not directly to EC2 instances.
D
The EC2 instance is not running the latest user data script.
Why wrong: User data does not affect IAM role usage.

Full breakdown with real-world context →

Question 13hardmultiple choice

Full question →

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket even though the IAM role attached to the instance has an Allow policy for s3:GetObject. The S3 bucket policy includes a Deny statement with the condition 'aws:SourceIp': ['10.0.0.0/8']. What is the likely cause of the failure?

A
The IAM role’s permissions boundary is blocking the action.
Why wrong: No permissions boundary mentioned.
B
The IAM role does not have an STS trust policy.
Why wrong: EC2 instances automatically assume roles without needing STS trust policy.
C
The S3 bucket is in a different region.
Why wrong: Cross-region access is allowed unless explicitly denied.
D
The Deny statement in the bucket policy is blocking the request because the EC2 instance’s IP falls within the 10.0.0.0/8 range.
The bucket policy denies all requests from the private IP range, including the EC2 instance.

Full breakdown with real-world context →

Question 14hardmultiple choice

Full question →

A financial services company has a production AWS account with hundreds of EC2 instances running a mix of Linux and Windows workloads. The security team is responsible for detecting and responding to security incidents. They have enabled CloudTrail, VPC Flow Logs, and GuardDuty. Recently, GuardDuty generated a finding indicating that an EC2 instance is communicating with a known malicious IP address. The security engineer needs to investigate the incident. The engineer examines the GuardDuty finding and sees the affected resource is an EC2 instance ID. The engineer wants to identify which user or role launched the instance and what security groups were associated with it at launch time. Which approach should the engineer take to gather this information?

A
Log in to the EC2 console and view the instance details under the 'Security' tab.
Why wrong: Console shows current state, not historical launch details.
B
Use AWS Systems Manager Inventory to collect metadata about the instance.
Why wrong: Inventory collects software and patch data, not launch user.
C
Search CloudTrail logs for the RunInstances event that created the instance, using the instance ID to filter.
CloudTrail captures the API call with user identity and parameters.
D
Use AWS Config to view the configuration history of the EC2 instance and check the security group changes.
Why wrong: Config shows configuration items but not the user who launched.

Full breakdown with real-world context →

These SCS-C02 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style SCS-C02 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related SCS-C02 topic practice pages

Threat Detection and Incident Response practice questions

Security Logging and Monitoring practice questions

Identity and Access Management practice questions

Management and Security Governance practice questions

Infrastructure Security practice questions

Data Protection practice questions

SCS-C02 fundamentals practice questions

SCS-C02 scenario practice questions

SCS-C02 troubleshooting practice questions

Practice scenarios

A company has a policy that requires all IAM users to use multi-factor authentication (MFA) to access the AWS Management Console. A user reports that they are unable to sign in even after configuring MFA. What is the most likely cause?

Refer to the exhibit. A security engineer is troubleshooting why an IAM user (Alice) cannot encrypt data using a KMS key. Alice has full S3 and KMS permissions via an IAM policy. The key policy is shown. Which statement explains the issue?

Exhibit

A security team is troubleshooting an issue where an IAM role assumed by a Lambda function is unable to write logs to CloudWatch Logs. The role has an attached policy that allows logs:CreateLogGroup and logs:PutLogEvents. What is a likely reason for the failure?

A security engineer is troubleshooting an issue where an IAM role used by an EC2 instance cannot access an S3 bucket, even though the role has an attached policy that grants s3:GetObject on the bucket. The bucket policy does not explicitly deny access. What is the most likely cause?

A company has an S3 bucket with a bucket policy that grants access to an IAM role used by an application running on EC2. The application is unable to read objects from the bucket, even though the IAM role has the necessary permissions. What is the most likely cause?

A company uses AWS Secrets Manager to rotate secrets for its RDS database. The rotation fails periodically, and the security team needs to troubleshoot. Which CloudWatch metric should be monitored to detect rotation failures?

A security engineer runs the above CloudTrail lookup command to investigate a change to the S3 bucket policy. The command only returns one event, but the engineer knows that the bucket policy was changed multiple times. What is the most likely reason?

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role has an attached policy that grants s3:GetObject on the bucket. However, the application on the EC2 instance is unable to read objects. What is the MOST likely cause?