How should I use these Troubleshooting practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Troubleshooting questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Troubleshooting domain.

SCS-C02 · topic practice

Troubleshooting practice questions

Practise AWS Certified Security Specialty SCS-C02 Troubleshooting practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

9 questionsDomain: Troubleshooting

Practice 10 questions Browse domain →

What the exam tests

What to know about Troubleshooting

Troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Troubleshooting exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Troubleshooting questions

9 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Review the full subnetting walkthrough →

A security engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises server over a Direct Connect virtual interface. The EC2 instance has a security group that allows outbound traffic to the on-premises CIDR block (10.0.0.0/16). The VPC has a route table entry pointing the on-premises CIDR to the virtual private gateway. The on-premises firewall shows that packets are received from the EC2 instance but responses are not reaching the instance. What is the most likely cause?

Trap 1: The network ACL for the subnet is blocking outbound traffic to the…

Outbound traffic is reaching on-premises, so NACL is not blocking outbound.

Trap 2: The virtual private gateway is not attached to the VPC.

If the gateway were not attached, outbound traffic would not reach on-premises.

Trap 3: The security group does not allow inbound traffic from the…

Security groups are stateful; if outbound is allowed, return traffic is automatically allowed.

Study all Troubleshooting common traps →

A
The on-premises router does not have a route pointing the VPC CIDR back to the Direct Connect interface.
Without a return route, responses from on-premises are dropped.
B
The network ACL for the subnet is blocking outbound traffic to the on-premises CIDR.
Why wrong: Outbound traffic is reaching on-premises, so NACL is not blocking outbound.
C
The virtual private gateway is not attached to the VPC.
Why wrong: If the gateway were not attached, outbound traffic would not reach on-premises.
D
The security group does not allow inbound traffic from the on-premises server.
Why wrong: Security groups are stateful; if outbound is allowed, return traffic is automatically allowed.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Troubleshooting explanation →

A security engineer is troubleshooting an issue where Amazon GuardDuty is not generating findings for a specific EC2 instance that is known to be compromised. The instance is in a VPC with VPC Flow Logs enabled. What could be the reason for the lack of findings?

Trap 1: CloudTrail is not enabled in the account.

CloudTrail records API calls, not network traffic; GuardDuty uses network data from VPC Flow Logs.

Trap 2: AWS Config is not enabled for the EC2 instance.

GuardDuty does not use AWS Config data for threat detection.

Trap 3: VPC Flow Logs are only enabled for the subnet, not the instance's…

VPC Flow Logs can be at VPC, subnet, or ENI level; any level that captures traffic to the instance works.

Study all Troubleshooting common traps →

A
CloudTrail is not enabled in the account.
Why wrong: CloudTrail records API calls, not network traffic; GuardDuty uses network data from VPC Flow Logs.
B
AWS Config is not enabled for the EC2 instance.
Why wrong: GuardDuty does not use AWS Config data for threat detection.
C
VPC Flow Logs are only enabled for the subnet, not the instance's ENI.
Why wrong: VPC Flow Logs can be at VPC, subnet, or ENI level; any level that captures traffic to the instance works.
D
VPC Flow Logs are not being delivered to CloudWatch Logs.
GuardDuty analyzes VPC Flow Logs data from CloudWatch Logs; without delivery, it cannot generate findings.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full Troubleshooting explanation →

A security engineer is troubleshooting why CloudTrail logs are not being delivered to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured to log management events. However, no log files appear in the bucket. What is the MOST likely cause?

Trap 1: The trail is not logging data events.

Management events are logged by default; this would not prevent delivery.

Trap 2: The S3 bucket is in a different AWS account.

CloudTrail can deliver to buckets in different accounts with proper cross-account permissions.

Trap 3: The bucket policy is missing a Deny statement.

The bucket policy allows CloudTrail to write; a Deny would block it, but the issue is likely missing KMS permissions.

Study all Troubleshooting common traps →

A
The trail is not logging data events.
Why wrong: Management events are logged by default; this would not prevent delivery.
B
The S3 bucket uses SSE-KMS encryption and the trail does not have permission to use the KMS key.
CloudTrail requires kms:Decrypt and kms:GenerateDataKey permissions on the KMS key to deliver logs to an encrypted bucket.
C
The S3 bucket is in a different AWS account.
Why wrong: CloudTrail can deliver to buckets in different accounts with proper cross-account permissions.
D
The bucket policy is missing a Deny statement.
Why wrong: The bucket policy allows CloudTrail to write; a Deny would block it, but the issue is likely missing KMS permissions.

Full breakdown with real-world context →

Question 4mediummulti select

Read the full Troubleshooting explanation →

A security engineer is troubleshooting an issue where CloudTrail is not delivering logs to an S3 bucket. The bucket policy appears correct. Which TWO additional steps should the engineer take to diagnose the issue? (Choose TWO.)

Trap 1: Check CloudWatch Logs for CloudTrail errors.

Not applicable.

Trap 2: Create an IAM role for CloudTrail with S3 write permissions.

Not needed.

Trap 3: Enable S3 server access logging on the bucket.

Not for CloudTrail delivery.

Study all Troubleshooting common traps →

A
Verify that the S3 bucket exists and is in the correct region.
Basic check.
B
Check CloudWatch Logs for CloudTrail errors.
Why wrong: Not applicable.
C
Create an IAM role for CloudTrail with S3 write permissions.
Why wrong: Not needed.
D
Enable S3 server access logging on the bucket.
Why wrong: Not for CloudTrail delivery.
E
Review the CloudTrail configuration in the AWS Management Console for error messages.
Shows delivery errors.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Troubleshooting explanation →

A security engineer is troubleshooting why Amazon GuardDuty is not generating findings for suspicious S3 API calls made by an IAM role. The engineer has verified that GuardDuty is enabled in the account and region. What is a likely reason for the missing findings?

Trap 1: VPC Flow Logs are not enabled for the VPC where the role is used.

VPC Flow Logs capture network traffic, not S3 API calls.

Trap 2: The account is not a Delegated Admin for GuardDuty.

Delegated Admin is for managing multiple accounts; it does not affect findings for a single account.

Trap 3: S3 data events are not enabled in CloudTrail.

GuardDuty uses CloudTrail management events for S3 API calls like PutObject, not data events.

Study all Troubleshooting common traps →

A
CloudTrail management events are not being logged for the IAM role.
GuardDuty relies on CloudTrail management events; if the trail excludes those events, findings may be missed.
B
VPC Flow Logs are not enabled for the VPC where the role is used.
Why wrong: VPC Flow Logs capture network traffic, not S3 API calls.
C
The account is not a Delegated Admin for GuardDuty.
Why wrong: Delegated Admin is for managing multiple accounts; it does not affect findings for a single account.
D
S3 data events are not enabled in CloudTrail.
Why wrong: GuardDuty uses CloudTrail management events for S3 API calls like PutObject, not data events.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full Troubleshooting explanation →

A security engineer is troubleshooting an issue where CloudTrail logs are not being delivered to the specified S3 bucket. The bucket policy allows CloudTrail to write objects. What is the MOST likely cause?

Trap 1: The S3 bucket uses server-side encryption with customer-provided…

CloudTrail supports SSE-S3, not SSE-C.

Trap 2: The S3 bucket does not have versioning enabled.

Versioning is optional for CloudTrail.

Trap 3: The S3 bucket is in a different AWS account.

Cross-account delivery is supported with proper permissions.

Study all Troubleshooting common traps →

A
The S3 bucket uses server-side encryption with customer-provided keys (SSE-C).
Why wrong: CloudTrail supports SSE-S3, not SSE-C.
B
The S3 bucket has a bucket policy that denies access to the CloudTrail service principal.
An explicit deny in the bucket policy would override the allow.
C
The S3 bucket does not have versioning enabled.
Why wrong: Versioning is optional for CloudTrail.
D
The S3 bucket is in a different AWS account.
Why wrong: Cross-account delivery is supported with proper permissions.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Troubleshooting explanation →

A security engineer is troubleshooting why CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured with the correct bucket name. However, no log files appear. What is the most likely cause?

Trap 1: The S3 bucket has an S3 Object Lock configuration that prevents…

Object Lock does not prevent writes; it only enforces retention settings after objects are written.

Trap 2: The S3 bucket is in a different AWS Region from the trail.

CloudTrail can deliver logs to a bucket in any region as long as the bucket policy allows cross-region access.

Trap 3: CloudTrail is not enabled in the AWS Region where the S3 bucket…

CloudTrail can be configured to deliver logs across regions; the trail's home region is the one where the trail is created.

Study all Troubleshooting common traps →

A
The S3 bucket has an S3 Object Lock configuration that prevents writes.
Why wrong: Object Lock does not prevent writes; it only enforces retention settings after objects are written.
B
The S3 bucket is in a different AWS Region from the trail.
Why wrong: CloudTrail can deliver logs to a bucket in any region as long as the bucket policy allows cross-region access.
C
CloudTrail is not enabled in the AWS Region where the S3 bucket resides.
Why wrong: CloudTrail can be configured to deliver logs across regions; the trail's home region is the one where the trail is created.
D
The S3 bucket uses AWS KMS server-side encryption (SSE-KMS) and the KMS key policy does not grant CloudTrail permission to use the key.
CloudTrail must have kms:GenerateDataKey and kms:Decrypt permissions on the KMS key to encrypt/decrypt log files.

Full breakdown with real-world context →

Question 8mediummultiple choice

Review the full subnetting walkthrough →

A security engineer is troubleshooting connectivity issues between two EC2 instances in the same VPC but different subnets. Both instances have security groups that allow all traffic from each other's security group. However, traffic is still blocked. What is the most likely cause?

Trap 1: The instances are in different VPCs.

The scenario states same VPC.

Trap 2: The route tables do not have a route between the subnets.

Route tables enable routing, but the main VPC route table typically allows local traffic.

Trap 3: VPC Flow Logs are not enabled.

Flow logs do not affect traffic flow.

Study all Troubleshooting common traps →

A
The instances are in different VPCs.
Why wrong: The scenario states same VPC.
B
The network ACL for one or both subnets is blocking the traffic.
Network ACLs are stateless and can block traffic even if security groups allow it.
C
The route tables do not have a route between the subnets.
Why wrong: Route tables enable routing, but the main VPC route table typically allows local traffic.
D
VPC Flow Logs are not enabled.
Why wrong: Flow logs do not affect traffic flow.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full NAT/PAT explanation →

A security engineer is troubleshooting why an EC2 instance in a private subnet cannot access the internet through a NAT gateway. The route table for the private subnet has a default route pointing to the NAT gateway. The NAT gateway is in a public subnet with a route to an internet gateway. What is the most likely cause of the issue?

Trap 1: The EC2 instance's security group is blocking outbound traffic.

The security group outbound rules would affect the instance, but the issue is at the NAT gateway level.

Trap 2: The NAT gateway's security group is blocking outbound traffic.

Security groups for NAT gateways have default outbound allow all; this is unlikely.

Trap 3: The NAT gateway does not have a route to the internet gateway in…

The NAT gateway uses the route table of the subnet it is in; if the subnet has a route to IGW, it works.

Study all Troubleshooting common traps →

A
The NAT gateway does not have an Elastic IP address associated.
A NAT gateway requires an Elastic IP for outbound traffic.
B
The EC2 instance's security group is blocking outbound traffic.
Why wrong: The security group outbound rules would affect the instance, but the issue is at the NAT gateway level.
C
The NAT gateway's security group is blocking outbound traffic.
Why wrong: Security groups for NAT gateways have default outbound allow all; this is unlikely.
D
The NAT gateway does not have a route to the internet gateway in its route table.
Why wrong: The NAT gateway uses the route table of the subnet it is in; if the subnet has a route to IGW, it works.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Troubleshooting sessions

Start a Troubleshooting only practice session

Every question in these sessions is drawn from the Troubleshooting domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Troubleshooting questions →Mixed SCS-C02 session

Frequently asked questions

What does the SCS-C02 exam test about Troubleshooting?: Troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Troubleshooting questions in a focused session?: Yes — the session launcher on this page draws every question from the Troubleshooting domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SCS-C02 topics?: Use the topic links above to move to related areas, or go back to the SCS-C02 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the SCS-C02 exam covers. They are not copied from any real exam or dump site.

Troubleshooting only

10 questions 20 questions 30 questions 50 questions

Mixed SCS-C02 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All SCS-C02 questions Troubleshooting domain overview SCS-C02 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Troubleshooting practice questions

What to know about Troubleshooting

Common Troubleshooting exam traps

Troubleshooting questions

A security engineer is troubleshooting an issue where Amazon GuardDuty is not generating findings for a specific EC2 instance that is known to be compromised. The instance is in a VPC with VPC Flow Logs enabled. What could be the reason for the lack of findings?

A security engineer is troubleshooting why CloudTrail logs are not being delivered to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured to log management events. However, no log files appear in the bucket. What is the MOST likely cause?

A security engineer is troubleshooting an issue where CloudTrail is not delivering logs to an S3 bucket. The bucket policy appears correct. Which TWO additional steps should the engineer take to diagnose the issue? (Choose TWO.)

A security engineer is troubleshooting why Amazon GuardDuty is not generating findings for suspicious S3 API calls made by an IAM role. The engineer has verified that GuardDuty is enabled in the account and region. What is a likely reason for the missing findings?

A security engineer is troubleshooting an issue where CloudTrail logs are not being delivered to the specified S3 bucket. The bucket policy allows CloudTrail to write objects. What is the MOST likely cause?

A security engineer is troubleshooting why CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured with the correct bucket name. However, no log files appear. What is the most likely cause?

A security engineer is troubleshooting connectivity issues between two EC2 instances in the same VPC but different subnets. Both instances have security groups that allow all traffic from each other's security group. However, traffic is still blocked. What is the most likely cause?

Track your progress over time

Start a Troubleshooting only practice session

Related SCS-C02 topic practice pages

Threat Detection and Incident Response practice questions

Security Logging and Monitoring practice questions

Identity and Access Management practice questions

Management and Security Governance practice questions

Infrastructure Security practice questions

Data Protection practice questions

SCS-C02 fundamentals practice questions

SCS-C02 scenario practice questions

SCS-C02 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid