SCS-C02 Practice Questions

Question 1

Which TWO of the following are valid ways to grant an IAM user permissions to access an S3 bucket? (Choose 2.)

Accepted Answer

Attach an IAM policy to the user.. Option C is correct because attaching an IAM identity-based policy directly to the user grants that user the specified S3 permissions, which is the standard way to authorize an IAM principal. Option D is correct because adding the user to an IAM group that has an S3 policy attached means the user inherits those permissions through group membership, another standard identity-based authorization method. Option A is incorrect because an instance profile is a container for an IAM role used by EC2 instances (and similar compute), not a mechanism for granting permissions to an IAM user. Option B is incorrect because a VPC endpoint policy controls which principals can access the service through that endpoint; it does not grant an IAM user permissions to an S3 bucket. Option E is incorrect because an SCP sets the maximum permissions boundary for accounts in an AWS Organization; it only restricts permissions and never grants access on its own.

Answer

Assign an instance profile to the user.

Answer

Create a VPC endpoint policy.

Answer

Use an SCP to allow access.

Question 2

Which TWO actions should a security engineer take to ensure that Amazon GuardDuty can effectively monitor for suspicious activity in a VPC? (Choose two.)

Accepted Answer

Enable DNS query logging and publish to CloudWatch Logs.. Amazon GuardDuty relies on DNS query logs to detect suspicious domain name resolution patterns, such as DNS tunneling or communication with known malicious domains. By enabling DNS query logging and publishing to CloudWatch Logs, GuardDuty can ingest this data as a source for its threat detection algorithms. Without DNS logs, GuardDuty cannot analyze DNS-based attack vectors within the VPC.

Answer

Enable CloudTrail data events for S3.

Answer

Enable S3 server access logs.

Answer

Enable AWS Config configuration history.

Question 3

A company uses AWS Organizations with multiple accounts. The security team wants to ensure that all newly created accounts automatically have AWS CloudTrail enabled, with logs delivered to a centralized S3 bucket. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an SCP that denies actions to disable CloudTrail and modify the S3 bucket policy. Use AWS CloudFormation StackSets to deploy a CloudTrail trail in each account.. The correct answer. SCPs cannot enable CloudTrail, but they can prevent disabling it and modifying the S3 bucket policy. To actually enable CloudTrail across all accounts with minimal overhead, AWS CloudFormation StackSets can deploy a CloudTrail trail in each account automatically. Option A is incorrect because SCPs cannot enable services—they only deny or allow actions. Option B is incorrect because AWS Trusted Advisor only checks and alerts; it does not enforce configurations. Option D is incorrect because AWS Config rules with auto-remediation can work but involve more setup and overhead compared to using StackSets, which is purpose-built for deploying resources across multiple accounts. Therefore, C provides the least operational overhead.

Answer

Create an SCP that enables CloudTrail and enforces log delivery to the centralized S3 bucket.

Answer

Use AWS Trusted Advisor to check CloudTrail status and send alerts to the security team.

Answer

Use AWS Config rules with auto-remediation to enable CloudTrail in each account.

Question 4

Refer to the exhibit. An IAM policy is attached to a group. An IAM user in that group attempts to stop an EC2 instance from IP address 198.51.100.10. What will happen?

Accepted Answer

The action is denied because the source IP does not match the allowed range. The IAM policy includes a `Deny` statement with a `NotIpAddress` condition that restricts all actions (including `StopInstances`) to the IP range `10.0.0.0/8`. Since the user's source IP is `198.51.100.10`, which falls outside this range, the deny statement explicitly blocks the action. In IAM, an explicit deny always overrides any allow, so the request is denied regardless of the allow statement in the first policy block.

Answer

The action is allowed because the first statement allows StopInstances

Answer

The action is allowed because the resource is '*'

Answer

The action is denied only if the user is not using MFA

Question 5

Refer to the exhibit. A security engineer runs the above command and sees the security group configuration. Based on the output, which statement is correct?

Accepted Answer

The security group allows HTTP traffic from the internet.. The security group output shows an inbound rule permitting HTTP (TCP port 80) from 0.0.0.0/0, which means any internet source can reach the instance on port 80. That is the definition of allowing HTTP traffic from the internet. The other statements either misread the output or describe attributes (outbound rules, instance associations) that are not determinable from the rule listing alone.

Answer

The security group has no outbound rules.

Answer

The security group allows SSH access from any IP address.

Answer

The security group is associated with multiple EC2 instances.

Question 6

A company uses AWS WAF to protect its web application from common web exploits. The security team wants to block requests that contain SQL injection or cross-site scripting (XSS) in the query string. Which rule type should be used?

Accepted Answer

Managed rule group for SQL injection and XSS. AWS WAF managed rule groups, such as the AWS-AWSManagedRulesSQLiRuleSet and AWS-AWSManagedRulesXSSRuleSet, are pre-configured to inspect query strings for SQL injection and cross-site scripting (XSS) patterns. Using a managed rule group is the most efficient and accurate approach because it leverages AWS's continuously updated threat signatures, reducing false positives and administrative overhead compared to custom rules.

Answer

Custom regex pattern set

Answer

Rate-based rule

Answer

Geographic match rule

Question 7

A company wants to centrally collect and analyze logs from multiple AWS accounts. Which AWS service should be used to aggregate logs from various sources for monitoring and alerting?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because it provides a centralized platform for collecting, monitoring, and analyzing log data from multiple AWS accounts and on-premises sources. It supports cross-account log aggregation via subscription filters and cross-account destinations, enabling real-time monitoring and alerting through CloudWatch Logs Insights and metric filters. This makes it the appropriate choice for the stated requirement of central log aggregation for monitoring and alerting.

Answer

Amazon S3

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

A company uses an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances in private subnets. The security team wants to ensure that only the ALB can communicate with the EC2 instances. Which security group configuration should be applied to the EC2 instances?

Accepted Answer

Allow inbound HTTP traffic from the ALB's security group. Security groups can reference other security groups as a source, allowing traffic only from resources associated with that security group. By specifying the ALB's security group as the source for inbound HTTP traffic, the EC2 instances will only accept traffic originating from the ALB, effectively restricting all other inbound traffic. This is a best practice for securing backend instances behind a load balancer.

Answer

Allow inbound HTTP traffic from the EC2 instances' own security group

Answer

Allow inbound HTTP traffic from 0.0.0.0/0

Answer

Allow inbound HTTP traffic from the VPC CIDR block

Question 9

A company uses AWS Organizations with multiple accounts. The security team wants a centralized view of all security alerts and findings from services like GuardDuty, Security Hub, and Inspector across all accounts. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS Security Hub with cross-account aggregation in the management account.. AWS Security Hub is designed to aggregate findings from multiple security services (GuardDuty, Inspector, etc.) across accounts. By enabling cross-account aggregation in the management account of AWS Organizations, Security Hub provides a single, centralized dashboard for all security alerts and findings without needing to collect raw logs or build custom dashboards. This is the most efficient and native approach for a multi-account environment.

Answer

Use AWS Systems Manager OpsCenter to centrally view all security findings.

Answer

Use individual service consoles (GuardDuty, Security Hub, Inspector) for each account.

Answer

Use Amazon CloudWatch Logs to collect logs from each account and create custom dashboards.

Question 10

A security engineer needs to generate a report of all AWS Identity and Access Management (IAM) users who have not used their access keys in the last 90 days. Which AWS service can provide this information?

Accepted Answer

AWS IAM Credentials Report. AWS IAM Credentials Report provides a CSV file with details about IAM users, including last activity dates. Option B is wrong because AWS CloudTrail logs API calls but does not provide a summary report. Option C is wrong because Amazon GuardDuty does not track IAM key usage. Option D is wrong because AWS Config evaluates configurations, not usage.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 11

A company is migrating on-premises databases to Amazon RDS for MySQL. The security team requires that data be encrypted at rest and in transit. Which combination of steps should the team take to meet these requirements?

Accepted Answer

Enable encryption at rest on the RDS instance and set the rds.force_ssl parameter to 1 in the DB parameter group.. Enabling encryption at rest on the RDS instance (which can be done during creation or via a snapshot copy with encryption enabled) and requiring SSL for connections (by setting the rds.force_ssl parameter to 1 in the DB parameter group) ensures data is encrypted both at rest and in transit. Option A is incorrect because an RDS proxy with TLS termination does not enforce encryption for direct connections to the database, and encryption at rest alone does not cover in-transit. Option C is incorrect because using a client-side encryption library is not a standard RDS feature and would require application changes; it does not provide at-rest encryption managed by RDS. Option D is incorrect because configuring the security group to allow only HTTPS traffic is for HTTP-based services, not for MySQL connections; MySQL uses a different protocol, and HTTPS does not apply to database connections.

Answer

Use an RDS proxy with TLS termination and enable encryption at rest.

Answer

Enable encryption at rest on the RDS instance and use a client-side encryption library.

Answer

Enable encryption at rest and configure the security group to allow only HTTPS traffic.

Question 12

A company uses AWS Organizations with multiple accounts. The security team needs to ensure that all accounts have CloudTrail enabled and that logs are delivered to a central S3 bucket. A new member account is created and the security engineer wants to enforce this configuration automatically. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts in the organization.. AWS CloudFormation StackSets allows you to deploy a CloudTrail template across all accounts in an AWS Organization from a single administrative account. This approach ensures that every new member account automatically receives the CloudTrail configuration as part of the StackSet's automatic deployment to accounts added to the organization, providing a fully automated, infrastructure-as-code solution with minimal operational overhead.

Answer

Use AWS Config rules to detect accounts without CloudTrail and trigger a remediation via Systems Manager Automation.

Answer

Use an SCP to deny cloudtrail:StopLogging and cloudtrail:DeleteTrail actions.

Answer

Create an AWS Lambda function that runs periodically to check and enable CloudTrail in each account.

Question 13

A security team wants to grant a Lambda function access to read from a DynamoDB table in the same account. What is the most secure way to do this?

Accepted Answer

Create an IAM role with a policy that allows only the required DynamoDB actions (e.g., GetItem, Query) on the specific table and assign it to the Lambda function.. The most secure method is D because it follows the principle of least privilege by creating a custom IAM role that grants only the necessary DynamoDB actions (like GetItem, Query) on the specific table. This limits the Lambda function's permissions to only what is required. Option A is incorrect because a VPC endpoint allows network access to DynamoDB but does not grant IAM permissions; the Lambda function still needs an IAM role with appropriate permissions. Option B is incorrect because attaching the managed policy AmazonDynamoDBFullAccess grants full access to all DynamoDB resources, violating least privilege and increasing security risk. Option C is incorrect because storing database access keys in Lambda environment variables exposes credentials and is insecure; the recommended approach is to use an IAM execution role.

Answer

Create a VPC endpoint for DynamoDB and associate it with the Lambda function.

Answer

Attach the AWS managed policy AmazonDynamoDBFullAccess to the Lambda execution role.

Answer

Store the database access keys in the Lambda environment variables.

Question 14

A company wants to restrict access to an Amazon S3 bucket so that only objects uploaded with server-side encryption using AWS KMS (SSE-KMS) are allowed. Which bucket policy condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. To enforce that all objects uploaded to an S3 bucket use SSE-KMS, you should use the bucket policy condition key `s3:x-amz-server-side-encryption` and set its value to `aws:kms`. This ensures the encryption header is `aws:kms` without requiring a specific KMS key. The key `s3:x-amz-server-side-encryption-aws-kms-key-id` is used only when you need to require a particular KMS key ARN.

Answer

s3:x-amz-server-side-encryption-customer-key

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

kms:EncryptionContext

Question 15

Refer to the exhibit. A security engineer runs the describe-instances command for an EC2 instance. The instance has a public IP address. The security group "allow-ssh-http" has inbound rules that allow SSH from 0.0.0.0/0 and HTTP from 0.0.0.0/0. The engineer wants to block SSH access from the internet while keeping HTTP access. Which change should be made?

Accepted Answer

Remove the inbound rule that allows SSH from 0.0.0.0/0 from the security group.. Security groups are stateful and support only allow rules; removing the inbound SSH rule from the security group effectively blocks SSH access from the internet (0.0.0.0/0) while the HTTP rule remains, allowing HTTP traffic. Since the instance already has a public IP address, removing the SSH rule is the simplest and most direct way to achieve the goal without affecting other traffic.

Answer

Add a network ACL rule to deny SSH inbound from 0.0.0.0/0.

Answer

Disassociate the public IP address from the instance.

Answer

Modify the security group to add a deny rule for SSH from 0.0.0.0/0.

AWS Certified Security Specialty SCS-C02 practice test

Three ways to study

Study SCS-C02 by domain

Study SCS-C02 by topic

Threat Detection and Incident Response practice questions

Identity and Access Management practice questions

Security Logging and Monitoring practice questions

Management and Security Governance practice questions

Infrastructure Security practice questions

Data Protection practice questions

SCS-C02 fundamentals practice questions

SCS-C02 scenario practice questions

SCS-C02 troubleshooting practice questions

Top SCS-C02 questions

AWS Certified Security Specialty SCS-C02 practice questions