Troubleshooting practice questions

A security engineer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket via a VPC endpoint. The bucket policy allows access only from the VPC endpoint. The instance has an IAM role that grants s3:GetObject on the bucket. The EC2 instance receives an AccessDenied error. What is the most likely cause?

Trap 1: The IAM role does not have sufficient permissions.

The role grants s3:GetObject, so permissions should be sufficient from IAM side.

Trap 2: The VPC endpoint policy is blocking the request.

Endpoint policy could block, but the problem statement says bucket policy allows only from VPC endpoint; the endpoint policy might not be the issue.

Trap 3: The EC2 instance's security group does not allow outbound traffic…

Security group would cause a timeout, not an AccessDenied error from S3.

A
The IAM role does not have sufficient permissions.
Why wrong: The role grants s3:GetObject, so permissions should be sufficient from IAM side.
B
The bucket policy does not include the aws:SourceVpce condition.
Without this condition, the bucket policy that restricts to VPC endpoint may not match the request, causing AccessDenied.
C
The VPC endpoint policy is blocking the request.
Why wrong: Endpoint policy could block, but the problem statement says bucket policy allows only from VPC endpoint; the endpoint policy might not be the issue.
D
The EC2 instance's security group does not allow outbound traffic to S3.
Why wrong: Security group would cause a timeout, not an AccessDenied error from S3.

Question 2mediummultiple choice

A security engineer is troubleshooting why CloudTrail is not delivering logs to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured with the correct bucket name. However, no log files appear. What is the most likely cause?

Trap 1: The S3 bucket has an S3 Object Lock configuration that prevents…

S3 Object Lock does not block initial PutObject requests; it only restricts deletion or overwriting of existing versions according to a retention mode and period. CloudTrail writes new log objects on a regular basis, and unless the bucket policy denies s3:PutObject, Object Lock will not prevent those deliveries. Even with a default retention policy, writes succeed and the logs are merely locked against modification.

Trap 2: The S3 bucket is in a different AWS Region from the trail.

CloudTrail can deliver log files to an S3 bucket in any AWS Region, not only the bucket's or trail's home region. The trail must have a bucket policy that permits the CloudTrail service principal to write objects, and the bucket may be in a different account or region. A regional mismatch alone is not a cause of delivery failure, so this does not explain the troubleshooting issue.

Trap 3: CloudTrail is not enabled in the AWS Region where the S3 bucket…

CloudTrail is a regional service, but a trail is created in a home region and can record and deliver events for all regions when configured as a multi-region trail. The S3 bucket resides in some region, but CloudTrail does not need to be enabled specifically in the bucket's region to deliver logs to it. What matters is that the trail is active and the bucket policy allows CloudTrail to write; the bucket region is irrelevant.

A
The S3 bucket has an S3 Object Lock configuration that prevents writes.
Why wrong: S3 Object Lock does not block initial PutObject requests; it only restricts deletion or overwriting of existing versions according to a retention mode and period. CloudTrail writes new log objects on a regular basis, and unless the bucket policy denies s3:PutObject, Object Lock will not prevent those deliveries. Even with a default retention policy, writes succeed and the logs are merely locked against modification.
B
The S3 bucket is in a different AWS Region from the trail.
Why wrong: CloudTrail can deliver log files to an S3 bucket in any AWS Region, not only the bucket's or trail's home region. The trail must have a bucket policy that permits the CloudTrail service principal to write objects, and the bucket may be in a different account or region. A regional mismatch alone is not a cause of delivery failure, so this does not explain the troubleshooting issue.
C
CloudTrail is not enabled in the AWS Region where the S3 bucket resides.
Why wrong: CloudTrail is a regional service, but a trail is created in a home region and can record and deliver events for all regions when configured as a multi-region trail. The S3 bucket resides in some region, but CloudTrail does not need to be enabled specifically in the bucket's region to deliver logs to it. What matters is that the trail is active and the bucket policy allows CloudTrail to write; the bucket region is irrelevant.
D
The S3 bucket uses AWS KMS server-side encryption (SSE-KMS) and the KMS key policy does not grant CloudTrail permission to use the key.
When a destination bucket uses SSE-KMS, CloudTrail must have permission to call kms:GenerateDataKey for encrypting each log file and kms:Decrypt for delivering or reading those files. If the KMS key policy does not explicitly grant CloudTrail these actions, PutObject requests to the bucket will fail even if the bucket policy is correct. CloudTrail’s role also needs the appropriate KMS permissions in the trail’s advanced settings, but the key policy is the critical constraint here.

Question 3mediummultiple choice

A security engineer is designing a monitoring solution for an AWS Lambda function that processes sensitive data. The function occasionally fails due to timeouts. The engineer needs to be alerted immediately when the function fails and also wants to analyze the error logs. Which combination of services should the engineer use?

Trap 1: Amazon CloudWatch Logs and Amazon Kinesis Data Firehose

Kinesis Firehose delivers data to destinations but does not provide immediate alerting.

Trap 2: AWS CloudTrail and Amazon SNS

CloudTrail logs API calls, not function execution details.

Trap 3: AWS Config and Amazon SNS

Config tracks configuration changes, not runtime errors.

A
Amazon CloudWatch Logs and Amazon Kinesis Data Firehose
Why wrong: Kinesis Firehose delivers data to destinations but does not provide immediate alerting.
B
Amazon CloudWatch Logs and CloudWatch Alarms with Amazon SNS
CloudWatch Logs stores logs, and CloudWatch Alarms trigger SNS notifications on errors.
C
AWS CloudTrail and Amazon SNS
Why wrong: CloudTrail logs API calls, not function execution details.
D
AWS Config and Amazon SNS
Why wrong: Config tracks configuration changes, not runtime errors.

Question 4hardmultiple choice

Refer to the exhibit. A security engineer is troubleshooting why an IAM user (Alice) cannot encrypt data using a KMS key. Alice has full S3 and KMS permissions via an IAM policy. The key policy is shown. Which statement explains the issue?

Exhibit

{
  "Version": "2012-10-17",
  "Id": "KMSKeyPolicy",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow access for Key Administrators",
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::123456789012:role/Admin"
        ]
      },
      "Action": [
        "kms:Create*",
        "kms:Put*"
      ],
      "Resource": "*"
    }
  ]
}

Trap 1: The key policy is missing a statement to allow the IAM user to use…

That would require 'kms:ViaService' condition, but here the key policy simply doesn't allow encrypt.

Trap 2: The IAM user does not have the kms:Encrypt permission in their IAM…

Alice has full KMS permissions via IAM, but key policy doesn't enable IAM policies.

Trap 3: The key policy does not include the root account principal

Root is included.

A
The key policy is missing a statement to allow the IAM user to use the key via IAM policies
Why wrong: That would require 'kms:ViaService' condition, but here the key policy simply doesn't allow encrypt.
B
The IAM user does not have the kms:Encrypt permission in their IAM policy
Why wrong: Alice has full KMS permissions via IAM, but key policy doesn't enable IAM policies.
C
The key policy does not include the root account principal
Why wrong: Root is included.
D
The key policy does not allow the IAM user to use the key for any action
Only Admin role gets kms:Put* and kms:Create*, not encrypt.

Question 5mediummultiple choice

A security engineer is troubleshooting an issue where an IAM role used by an EC2 instance cannot access an S3 bucket, even though the role has an attached policy that grants s3:GetObject on the bucket. The bucket policy does not explicitly deny access. What is the most likely cause?

Trap 1: A service control policy (SCP) is denying access

SCPs are not mentioned, and they would deny at the account level.

Trap 2: The IAM policy is attached to the user instead of the role

The role has the policy attached, so that should work.

Trap 3: The bucket has an explicit deny in its policy

The question states the bucket policy does not explicitly deny.

A
A service control policy (SCP) is denying access
Why wrong: SCPs are not mentioned, and they would deny at the account level.
B
The bucket policy does not grant access to the IAM role
When using an IAM role, the bucket policy must explicitly allow the role, otherwise the implicit denial applies.
C
The IAM policy is attached to the user instead of the role
Why wrong: The role has the policy attached, so that should work.
D
The bucket has an explicit deny in its policy
Why wrong: The question states the bucket policy does not explicitly deny.

Review the full subnetting walkthrough →

Question 6hardmultiple choice

A security engineer is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises server over a Direct Connect virtual interface. The EC2 instance has a security group that allows outbound traffic to the on-premises CIDR block (10.0.0.0/16). The VPC has a route table entry pointing the on-premises CIDR to the virtual private gateway. The on-premises firewall shows that packets are received from the EC2 instance but responses are not reaching the instance. What is the most likely cause?

Trap 1: The network ACL for the subnet is blocking outbound traffic to the…

If the subnet's network ACL were blocking outbound traffic to the on-premises CIDR, the VPC instances would be unable to send any packets toward Direct Connect, and the on-premises side would receive nothing at all. The scenario demonstrates that outbound traffic is reaching the on-premises network, which proves the NACL is permitting the egress flow. NACLs are stateless and require explicit allow rules for both outbound and inbound traffic, but here only the return path is broken.

Trap 2: The virtual private gateway is not attached to the VPC.

A virtual private gateway that is not attached to the VPC would leave the VPC route table without any viable target for Direct Connect traffic, preventing all outbound packets from ever leaving the VPC. Since the observed symptoms show outbound traffic successfully arriving at on-premises, the gateway must be attached and operational. An unattached gateway would be a total connectivity failure, not a one-way connectivity issue.

Trap 3: The security group does not allow inbound traffic from the…

Security groups are stateful: if the instance's outbound rule permits traffic to the on-premises server, the security group automatically allows the corresponding inbound response traffic, even without an explicit inbound rule. Therefore, a missing inbound rule for the on-premises CIDR cannot cause the return packets to be dropped. The issue lies in an external router lacking a return route, not in the security group configuration.

A
The on-premises router does not have a route pointing the VPC CIDR back to the Direct Connect interface.
The VPC has a route for the on-premises CIDR pointing to the virtual private gateway, so outbound packets traverse the Direct Connect virtual interface. However, for successful two-way communication, the on-premises router must have a route for the VPC CIDR that points back to the same Direct Connect interface. Because this return route is missing, response packets are either sent to a default route or dropped, so hosts in the VPC see no replies. This is a classic asymmetric routing failure.
B
The network ACL for the subnet is blocking outbound traffic to the on-premises CIDR.
Why wrong: If the subnet's network ACL were blocking outbound traffic to the on-premises CIDR, the VPC instances would be unable to send any packets toward Direct Connect, and the on-premises side would receive nothing at all. The scenario demonstrates that outbound traffic is reaching the on-premises network, which proves the NACL is permitting the egress flow. NACLs are stateless and require explicit allow rules for both outbound and inbound traffic, but here only the return path is broken.
C
The virtual private gateway is not attached to the VPC.
Why wrong: A virtual private gateway that is not attached to the VPC would leave the VPC route table without any viable target for Direct Connect traffic, preventing all outbound packets from ever leaving the VPC. Since the observed symptoms show outbound traffic successfully arriving at on-premises, the gateway must be attached and operational. An unattached gateway would be a total connectivity failure, not a one-way connectivity issue.
D
The security group does not allow inbound traffic from the on-premises server.
Why wrong: Security groups are stateful: if the instance's outbound rule permits traffic to the on-premises server, the security group automatically allows the corresponding inbound response traffic, even without an explicit inbound rule. Therefore, a missing inbound rule for the on-premises CIDR cannot cause the return packets to be dropped. The issue lies in an external router lacking a return route, not in the security group configuration.

Question 7mediummultiple choice

A security engineer is troubleshooting why CloudTrail logs are not being delivered to an S3 bucket. The bucket policy allows CloudTrail to write objects, and the trail is configured to log management events. However, no log files appear in the bucket. What is the MOST likely cause?

Trap 1: The trail is not logging data events.

Data events are not captured by default, but CloudTrail logs management events automatically for every trail. If the trail is not configured to record data events, you simply won't see S3 object-level API calls in the delivered logs; this does not block CloudTrail from writing the management event log files it is generating. Because the delivery failure affects all event categories, including management events, the absence of data-event logging is not the root cause.

Trap 2: The S3 bucket is in a different AWS account.

CloudTrail is designed to deliver logs to an S3 bucket in another AWS account as long as the destination bucket has a bucket policy that grants CloudTrail's delivery role s3:PutObject (and optionally s3:GetBucketAcl). Cross-account delivery is a common architecture for centralizing logs, so the bucket being in a different account is not an inherent blocker. If the cross-account permissions were misconfigured, that could cause a failure, but the symptom described here is most consistent with an SSE-KMS permission problem, not a cross-account one.

Trap 3: The bucket policy is missing a Deny statement.

The bucket policy for a CloudTrail destination should contain an Allow statement that grants CloudTrail permission to write objects (s3:PutObject) to the bucket. The absence of a Deny statement cannot cause log delivery to fail because access is denied by default unless an Allow explicitly grants it; a missing Allow would be the problem. Adding a Deny might block delivery, but lacking one does not prevent CloudTrail from writing.

A
The trail is not logging data events.
Why wrong: Data events are not captured by default, but CloudTrail logs management events automatically for every trail. If the trail is not configured to record data events, you simply won't see S3 object-level API calls in the delivered logs; this does not block CloudTrail from writing the management event log files it is generating. Because the delivery failure affects all event categories, including management events, the absence of data-event logging is not the root cause.
B
The S3 bucket uses SSE-KMS encryption and the trail does not have permission to use the KMS key.
When an S3 bucket uses SSE-KMS encryption, CloudTrail must have permission to call the KMS key to encrypt each delivered log file. Specifically, CloudTrail needs kms:Decrypt and kms:GenerateDataKey actions in the key policy. If those permissions are missing, CloudTrail cannot write the encrypted log objects and stops delivering logs, producing a delivery failure shown on the trail configuration page.
C
The S3 bucket is in a different AWS account.
Why wrong: CloudTrail is designed to deliver logs to an S3 bucket in another AWS account as long as the destination bucket has a bucket policy that grants CloudTrail's delivery role s3:PutObject (and optionally s3:GetBucketAcl). Cross-account delivery is a common architecture for centralizing logs, so the bucket being in a different account is not an inherent blocker. If the cross-account permissions were misconfigured, that could cause a failure, but the symptom described here is most consistent with an SSE-KMS permission problem, not a cross-account one.
D
The bucket policy is missing a Deny statement.
Why wrong: The bucket policy for a CloudTrail destination should contain an Allow statement that grants CloudTrail permission to write objects (s3:PutObject) to the bucket. The absence of a Deny statement cannot cause log delivery to fail because access is denied by default unless an Allow explicitly grants it; a missing Allow would be the problem. Adding a Deny might block delivery, but lacking one does not prevent CloudTrail from writing.