Hard — SCS-C02 Practice Quiz

Question 1

A security team at a large enterprise manages 120 AWS accounts under AWS Organizations. They need to deploy a standardized set of AWS Config rules across all existing and future member accounts to enforce a PCI DSS baseline. The team wants to manage these rules centrally from a dedicated security tooling account (not the management account) and ensure that member account administrators cannot delete or modify the deployed rules. Which approach best meets these requirements with the least ongoing operational effort?

Accepted Answer

Register the security tooling account as a delegated administrator for AWS Config, then deploy an organization conformance pack from that account targeting the entire organization.

Answer

Create a CloudFormation StackSet from the management account that provisions individual AWS Config rules in each member account, and re-run the StackSet manually whenever a new account is added.

Answer

Deploy a conformance pack independently in each member account using a script that assumes a cross-account role, scheduling the script to run daily to catch new accounts.

Answer

Enable AWS Config in the management account only and rely on an SCP that denies config:DeleteConfigRule to protect the rules across the organization.

Question 2

A security governance team manages 60 accounts under AWS Control Tower. Leadership requires that no account be able to create publicly accessible RDS instances, and that any existing RDS instance that becomes publicly accessible be automatically detected and reported to a central compliance dashboard. The team wants to minimize ongoing operational overhead while enforcing this at scale. Which combination of controls best satisfies both the preventive and detective requirements?

Accepted Answer

Apply an SCP to the organizational root that denies the RDS API actions when the request sets PubliclyAccessible to true, and deploy a Config conformance pack with the rds-instance-public-access-check rule aggregated into the audit account.

Answer

Deploy a Config rule with an automatic remediation action in each account and rely on Control Tower drift detection to prevent public RDS instances from being created.

Answer

Enable a Security Hub foundational security best practices control in every account and configure GuardDuty to block RDS creation calls that set PubliclyAccessible to true.

Answer

Create an IAM permissions boundary in each account that denies RDS creation with public access, and use CloudTrail Insights to detect any instances that become publicly accessible.

Question 3

A financial services company runs 120 accounts under AWS Control Tower. The security team must audit whether every account continuously enforces a set of ~40 detective controls (Config rules) mapped to their internal compliance framework. Finance has flagged that AWS Config recording costs have grown rapidly because every account records ALL resource types, including many that are irrelevant to the compliance framework. The team wants to reduce Config cost while still meeting the audit requirement and managing controls centrally across the organization. Which approach best balances centralized governance, audit coverage, and cost?

Accepted Answer

Deploy the 40 Config rules as a conformance pack via Control Tower/Config across the organization, and adjust the Config recorder in each account to record only the specific resource types evaluated by those rules.

Answer

Turn off AWS Config in accounts that show high cost and rely on a monthly manual review using AWS Config snapshots exported to S3 for the audit evidence.

Answer

Replace AWS Config entirely with a set of scheduled Lambda functions in each account that describe resources and write compliance results to a central DynamoDB table.

Answer

Enable Security Hub CIS and PCI standards in all accounts instead of Config rules, since Security Hub does not incur Config recording charges.

Question 4

A security engineer receives a GuardDuty finding of type Stealth:IAMUser/CloudTrailLoggingDisabled indicating an attacker used compromised credentials to stop logging on the organization's primary CloudTrail trail. The engineer must restore audit visibility as quickly as possible and ensure logging cannot be trivially disabled again by the same technique. Which combination of actions BEST addresses both the immediate recovery and future prevention?

Accepted Answer

Re-enable the CloudTrail trail (StartLogging), then apply an SCP that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail to all principals except a break-glass role, and enable an organization trail so member accounts cannot disable it locally.

Answer

Delete the affected trail and create a new one in a different Region, relying on GuardDuty to continue monitoring without CloudTrail.

Answer

Enable CloudTrail log file integrity validation and rotate the compromised access keys, which will automatically restart logging on the stopped trail.

Answer

Turn on VPC Flow Logs and Amazon S3 server access logging as replacement data sources, since these cover the same events that CloudTrail records.

Question 5

A security engineer receives a GuardDuty finding of type UnauthorizedAccess:EC2/MaliciousIPCaller.Custom for a production EC2 instance. The organization requires that suspected compromised instances be automatically isolated for forensic investigation while preserving all volatile and non-volatile data, and while allowing forensic tooling in a separate account to access the evidence. Which automated response best meets these requirements?

Accepted Answer

Trigger an EventBridge rule on the GuardDuty finding that invokes a Lambda function to attach a forensic isolation security group with no rules to the instance, create snapshots of all EBS volumes and share them with the forensics account, and capture a memory dump via an SSM Run Command before any termination.

Answer

Configure EventBridge to invoke a Lambda function that immediately terminates the instance and deletes its EBS volumes, then emails the security team so they can rebuild from the latest AMI.

Answer

Enable Security Hub auto-remediation to stop the instance, detach its network interface, and move the finding to archived status so the on-call team can review it during business hours.

Answer

Create an EventBridge rule that triggers an SSM Automation runbook to reboot the instance, rotate its IAM role credentials, and apply the latest OS patches to remove the malware.

Question 6

A security engineer receives a GuardDuty finding of type UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS. The finding indicates that credentials from an EC2 instance's IAM role were used from an IP address outside AWS. The instance itself is still running normally and serving production traffic, and the team cannot immediately terminate or isolate it without causing an outage. What is the MOST effective immediate containment action to stop the attacker from continuing to use the stolen credentials?

Accepted Answer

Attach an IAM policy to the instance role that denies all actions when the request does not originate from the instance's VPC using the aws:SourceVpc or aws:VpcSourceIp condition keys, effectively revoking the exfiltrated session's access

Answer

Rotate the EC2 instance's SSH key pair and reboot the instance to force new temporary credentials to be issued by the metadata service

Answer

Enable IMDSv2 in required mode on the running instance so the exfiltrated credentials are immediately invalidated

Answer

Create a GuardDuty suppression rule for the finding so the SOC can continue monitoring the instance without alert noise while planning a maintenance window

Question 7

A security team enables GuardDuty Lambda Protection across their organization. GuardDuty raises a finding indicating one of the company's Lambda functions is generating network traffic to a known cryptomining domain. The function is triggered by an SQS queue that processes customer uploads. The team must contain the threat quickly while preserving the ability to investigate how the function was compromised. Which action best achieves immediate containment with minimal disruption to unrelated workloads?

Accepted Answer

Set the function's reserved concurrency to zero and remove its execution role permissions, leaving the code and configuration intact for analysis.

Answer

Delete the Lambda function immediately and redeploy a clean version from the last known-good CI/CD artifact.

Answer

Add a deny-all NACL to the VPC subnet the account uses so the function can no longer reach the internet.

Answer

Disable the SQS queue trigger by deleting the source queue so the function stops receiving events.

Question 8

A security team enables GuardDuty Malware Protection for EC2. GuardDuty generates an 'Execution:EC2/MaliciousFile' finding after scanning an EBS volume attached to a production instance and detecting a trojan. The team wants an automated, least-disruptive first response that preserves the ability to investigate while preventing the malware from spreading laterally, and they must ensure the finding and any related activity remain fully investigable afterward. Which approach best meets these requirements?

Accepted Answer

Trigger an EventBridge rule on the finding that invokes a Lambda function to replace the instance's security groups with an isolation security group that denies all traffic, tag the instance for forensics, and create Detective and investigation entries before analysts examine it.

Answer

Configure an EventBridge rule to invoke a Lambda function that immediately terminates the affected EC2 instance to stop the malware from executing further.

Answer

Create a Security Hub suppression rule for the 'Execution:EC2/MaliciousFile' finding type so the alert stops recurring, then patch the instance during the next maintenance window.

Answer

Use Systems Manager Run Command to run an antivirus removal script on the instance automatically, delete the infected files, and leave the instance in service.

Question 9

A security engineer discovers that Amazon GuardDuty was intentionally disabled in the production account three weeks ago by a departing administrator, leaving a detection gap. The incident-response team needs to restore threat detection and, as part of recovery, retroactively understand what malicious activity may have occurred during the blind period without waiting weeks for new findings to accumulate. Which approach best supports both re-enabling detection and analyzing the historical gap?

Accepted Answer

Re-enable GuardDuty for ongoing detection, then use Amazon Detective and query the preserved CloudTrail, VPC Flow Logs, and DNS logs in CloudTrail Lake / Athena to reconstruct and investigate activity during the gap.

Answer

Re-enable GuardDuty and rely on its automatic backfill to reprocess VPC Flow Logs and CloudTrail from the past three weeks to generate retroactive findings.

Answer

Restore GuardDuty from a snapshot taken before it was disabled so that the previously generated findings and detection state are recovered.

Answer

Enable GuardDuty in a new dedicated security account and enable Malware Protection to scan existing EBS volumes for indicators from the past three weeks.

Question 10

A company uses AWS IAM Identity Center (successor to AWS SSO) with an external SAML 2.0 identity provider. Workforce users are assigned to multiple AWS accounts through permission sets. The security team wants to grant each user access only to EC2 instances tagged with their department, without creating a separate permission set per department, and without editing policies whenever a new department is added. Which approach best achieves this at scale?

Accepted Answer

Configure the identity provider to pass a department attribute as a session tag, enable attribute-based access control (ABAC) in IAM Identity Center, and write permission set policies that use aws:PrincipalTag/department conditions matching resource tags.

Answer

Create one permission set per department with inline policies scoped to each department's resource tags, and reassign users whenever their department changes.

Answer

Attach a permission boundary to each permission set that denies access to any EC2 instance not tagged with the department, and update the boundary as departments are added.

Answer

Use an SCP at the organization root that restricts EC2 access based on the user's department tag propagated from the identity provider.

Question 11

A security engineer attaches a permission boundary to an IAM role that allows only Amazon S3 and Amazon DynamoDB actions. The role's identity-based policy grants full access to S3, DynamoDB, and Amazon SQS. The AWS account belongs to an organization whose SCP allows S3 and SQS actions but does not include DynamoDB. There is no explicit deny anywhere. When the role attempts each service, which actions are effectively allowed?

Accepted Answer

Only Amazon S3 actions are allowed.

Answer

Amazon S3 and Amazon DynamoDB actions are allowed.

Answer

Amazon S3, DynamoDB, and SQS actions are all allowed.

Answer

Only Amazon S3 and SQS actions are allowed.

Question 12

A security engineer is reviewing a customer-managed IAM policy attached to a developer group. The policy contains a single statement with "Effect": "Allow", "NotAction": ["iam:*", "organizations:*"], and "Resource": "*". Developers report they can perform far more actions than intended, including deleting production S3 buckets and modifying KMS keys. What is the most accurate explanation of this behavior?

Accepted Answer

The NotAction element with Allow grants permission to every AWS action except those in the list, so developers are effectively allowed all non-IAM, non-Organizations actions on all resources.

Answer

NotAction only functions inside Deny statements, so this policy grants nothing and the developers' access must come from another attached policy.

Answer

NotAction with Allow implicitly denies the listed actions, but grants only S3 and KMS actions because those are the services the developers are using.

Answer

The Resource "*" combined with NotAction restricts the policy to read-only actions across all services, so bucket deletion should not be possible.

Question 13

A data engineering team uses an automation pipeline that assumes RoleA in Account 1 via STS. From within that session, the pipeline then assumes RoleB in Account 2 to access data. RoleB has a MaxSessionDuration of 12 hours, and the pipeline requests a 6-hour session when calling AssumeRole for RoleB. The team observes that the credentials for RoleB consistently expire after only 1 hour, causing long-running jobs to fail. What is the cause of this behavior?

Accepted Answer

Role chaining limits the assumed role session to a maximum of 1 hour, regardless of the requested DurationSeconds or the role's MaxSessionDuration.

Answer

The MaxSessionDuration on RoleB must be increased to at least 6 hours, because it currently overrides the requested duration.

Answer

A permissions boundary attached to RoleB is capping the session duration to 1 hour.

Answer

STS temporary credentials always expire after 1 hour and cannot be extended under any circumstances.

Question 14

A company grants a partner account access to a shared S3 bucket via a bucket policy. The security team wants every principal in the partner account to be allowed to read objects EXCEPT for one specific IAM role named 'ContractorRole', which must never be able to read the objects regardless of that role's identity-based permissions. Which S3 bucket policy construct enforces this most reliably?

Accepted Answer

An Allow statement for the partner account root, plus a Deny statement with Principal set to the ContractorRole ARN for the s3:GetObject action

Answer

An Allow statement with Principal set to the partner account root ARN, plus a separate Deny statement using NotPrincipal to exclude ContractorRole

Answer

A single Allow statement using NotPrincipal set to ContractorRole so all other principals are permitted

Answer

An Allow statement for the partner account root and rely on the partner administrator to attach a permission boundary to ContractorRole

Question 15

A security engineer at a company using AWS Organizations must enforce that all member accounts can only operate in the eu-west-1 and eu-central-1 regions to meet data residency requirements. However, the finance team needs global services such as IAM, CloudFront, and Route 53 to continue functioning, and one designated account (the networking account) must additionally be allowed to use us-east-1 for a legacy Direct Connect gateway configuration. What is the MOST effective way to implement this using Service Control Policies (SCPs)?

Accepted Answer

Attach an SCP to the root that denies all actions when aws:RequestedRegion is not in the approved region list, using a NotAction element to exempt global services, and attach a separate less-restrictive SCP only to the networking account's OU that includes us-east-1.

Answer

Attach an SCP to each OU with an Allow statement listing only the eu-west-1 and eu-central-1 regions, relying on the implicit deny to block all other regions including global services.

Answer

Create an IAM permission boundary on every role in the member accounts that denies actions outside the approved regions, and add a condition exception for the networking account.

Answer

Attach a single SCP to the organization root that denies all actions when aws:RequestedRegion is not eu-west-1 or eu-central-1, and manually add us-east-1 to the same policy so the networking account can use it.

Question 16

A company's production account (Account A) encrypts EBS snapshots with a customer managed KMS key. The DR team in a separate account (Account B) needs to copy these shared snapshots and restore volumes from them in Account B. The security team has already shared the snapshots with Account B via the snapshot sharing feature. However, when Account B attempts to copy the snapshot, the operation fails with an access denied error. What must the security team configure to allow Account B to successfully copy and restore the encrypted snapshots while following least privilege?

Accepted Answer

Update the KMS key policy in Account A to grant Account B the permissions kms:DescribeKey, kms:CreateGrant, kms:Decrypt, and kms:ReEncrypt*, and ensure the IAM principal in Account B has matching KMS permissions in its identity policy.

Answer

Disable encryption on the source snapshots in Account A before sharing them, so Account B can copy plaintext snapshots without needing KMS access.

Answer

Enable automatic key rotation on the KMS key in Account A, which propagates the rotated key material to Account B and grants implicit cross-account decrypt access.

Answer

Add Account B as a principal in a resource policy on the EBS snapshot itself, granting ec2:CopySnapshot and ec2:CreateVolume permissions.

Question 17

A security engineer is designing envelope encryption for a multi-tenant SaaS application. Each tenant's data is encrypted with a shared AWS KMS customer managed key. The engineer wants to ensure that ciphertext encrypted for one tenant cannot be decrypted while claiming a different tenant's identity, without creating a separate KMS key per tenant. Which approach best achieves this cryptographic binding?

Accepted Answer

Pass an encryption context containing the tenant ID on every Encrypt and Decrypt call, and enforce the matching context in the KMS key policy conditions.

Answer

Store each tenant ID as a resource tag on the KMS key and rely on ABAC to isolate decrypt operations.

Answer

Enable automatic key rotation so each tenant receives a distinct backing key version.

Answer

Use a KMS grant per tenant that includes the tenant ID in the grant name to scope decryption.

Question 18

A financial services company must retain full control over the cryptographic material used to encrypt sensitive data in Amazon S3. To meet compliance, they create a KMS key with an origin of EXTERNAL and import their own 256-bit key material, setting it to expire after 90 days. As the expiration date approaches, the security team wants to ensure encrypted objects remain decryptable without disruption. Which action correctly extends the ability to use this key?

Accepted Answer

Reimport the exact same key material into the existing KMS key before or after expiration, optionally setting a new expiration date.

Answer

Enable automatic annual key rotation on the KMS key so AWS generates new material before expiration.

Answer

Create a new KMS key with imported material and re-encrypt all existing S3 objects before the old key expires.

Answer

Use the ImportKeyMaterial API to import a new, different 256-bit key into the same key to replace the expiring material.

Question 19

A financial services company classifies data into three tiers: Public, Internal, and Restricted. Restricted data must be encrypted with a dedicated KMS customer managed key, and the security team requires that any object tagged 'classification=Restricted' stored in S3 be encrypted only with that specific key. Developers currently upload objects using SSE-KMS but can select any KMS key in the account. The security team wants to enforce that Restricted-classified uploads fail unless the correct CMK is used, while allowing other keys for lower tiers. Which approach BEST enforces this requirement?

Accepted Answer

Apply an S3 bucket policy that denies s3:PutObject when the request tag 'classification' equals 'Restricted' and the s3:x-amz-server-side-encryption-aws-kms-key-id condition does not match the dedicated CMK ARN.

Answer

Set the bucket's default encryption to the dedicated CMK and enable a bucket key so all objects automatically use the Restricted key regardless of classification.

Answer

Attach a key policy to the dedicated CMK that denies kms:Encrypt unless the caller passes an encryption context of 'classification=Restricted'.

Answer

Create an SCP that denies s3:PutObject across the organization unless the request specifies the dedicated CMK ARN as the encryption key.

Question 20

A company stores encrypted application backups in S3 buckets located in us-east-1 and eu-west-1. All objects are encrypted using SSE-KMS with a single-Region customer managed key created in us-east-1. During a disaster recovery test, an EC2 instance running in eu-west-1 fails to decrypt objects that were replicated to the eu-west-1 bucket, returning an error even though the IAM role has kms:Decrypt permission and the key policy grants access to that role. What is the MOST likely cause and the recommended fix?

Accepted Answer

A single-Region KMS key can only be used to encrypt/decrypt in the Region where it was created; use a multi-Region key with a replica in eu-west-1 so the data can be decrypted locally.

Answer

The IAM role is missing kms:GenerateDataKey; add that permission so the eu-west-1 instance can decrypt the replicated objects.

Answer

S3 replication cannot copy SSE-KMS encrypted objects across Regions; disable KMS encryption on the destination bucket and use SSE-S3 instead.

Answer

The key policy must grant kms:Decrypt to the S3 service principal in eu-west-1; add s3.eu-west-1.amazonaws.com as a principal in the key policy.

Question 21

A financial services company encrypts sensitive customer records in an S3 bucket using a customer managed KMS key. Security policy requires that decryption of these records is only possible from within the company's VPC, using a VPC endpoint for KMS, and never from the public internet or other networks. Application EC2 instances in private subnets access the data through an interface VPC endpoint for KMS. Which approach best enforces this requirement?

Accepted Answer

Add a condition to the KMS key policy that denies kms:Decrypt unless the request originates through the specific KMS VPC endpoint, using the aws:sourceVpce condition key.

Answer

Attach a bucket policy to the S3 bucket that denies s3:GetObject requests unless they come from the VPC endpoint for S3.

Answer

Enable automatic key rotation on the KMS key and restrict the key alias to the VPC using a resource tag condition.

Answer

Create a KMS grant scoped to the EC2 instance role and remove all key policy statements so only the grant controls access.

Question 22

A security engineer creates a customer managed KMS key using the AWS CLI and specifies a custom key policy. The policy grants encrypt/decrypt permissions to a specific application IAM role but does NOT include any statement granting the account root principal access, and it does not enable IAM policies to control the key. Several weeks later, the application role is accidentally deleted during a cleanup, and no other principal can manage or use the key. What is the state of the key and the recommended prevention?

Accepted Answer

The key is unmanageable and effectively unrecoverable through normal means; contact AWS Support. To prevent this, key policies should always include a statement giving the account root principal full kms:* access so IAM administration remains possible.

Answer

The key automatically falls back to the AWS managed key policy, so any IAM administrator can immediately regain access; no prevention is needed.

Answer

Enabling automatic key rotation on the key would have restored access because rotation regenerates the key policy with default permissions.

Answer

The key can be recovered by any principal with the AdministratorAccess managed policy, because IAM administrator permissions always override KMS key policies.

Question 23

A financial services company stores encrypted objects in an S3 bucket using an SSE-KMS customer managed key. A newly created AWS Lambda function (assuming an execution role) needs to read and decrypt these objects, but developers report AccessDenied errors on kms:Decrypt even though the Lambda execution role has an identity-based policy granting kms:Decrypt on the key. The KMS key policy currently contains only a statement granting the account root full access. What is the MOST likely cause and the correct fix that follows least privilege?

Accepted Answer

The key policy must be updated to explicitly grant the Lambda execution role kms:Decrypt, or the existing root statement must remain to allow IAM identity-based policies to take effect for principals in the account.

Answer

The Lambda function cannot use customer managed keys; it must be reconfigured to use an AWS managed key (aws/lambda) instead.

Answer

Key rotation must be enabled on the customer managed key so that Lambda can decrypt newly written objects.

Answer

An S3 bucket policy must grant the Lambda role kms:Decrypt, since KMS permissions for S3 objects are evaluated through the bucket policy.

Question 24

A financial services company encrypts sensitive customer records in an S3 bucket using a customer managed KMS key. A newly deployed analytics application running on EC2 instances (using an instance profile role) must decrypt these objects only between 01:00 and 05:00 UTC each day when batch jobs run. The security team wants to grant the minimum necessary access without modifying the KMS key policy, which is centrally controlled and change-controlled by a separate team. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant for the EC2 instance role with the Decrypt operation, and add a time-based condition to the analytics application's IAM policy restricting kms:Decrypt to the 01:00-05:00 UTC window.

Answer

Add the EC2 instance role as a principal in the KMS key policy with a DateGreaterThan/DateLessThan condition on the daily time window.

Answer

Create a KMS grant that includes a constraint limiting the grant to specific hours of the day so decryption only occurs during the batch window.

Answer

Attach an SCP to the account that denies kms:Decrypt outside the 01:00-05:00 UTC window and rely on the existing key policy for authorization.

Question 25

A data engineering team stores analytics output in an S3 bucket encrypted with a customer managed KMS key. An IAM role used by a Glue job has an identity-based policy granting kms:Decrypt and kms:GenerateDataKey on the key's ARN, plus full S3 access to the bucket. The Glue job fails with an AccessDenied error when writing encrypted objects. The KMS key policy contains only the default statement granting the account root full access, and no additional statements. Why is the job failing, and what is the minimal correct fix?

Accepted Answer

The key policy must explicitly grant the Glue role's principal (or delegate to IAM via the root statement combined with an IAM policy) permission to use the key; add a key policy statement allowing the role's kms:Decrypt and kms:GenerateDataKey, or confirm the account delegates to IAM.

Answer

Identity-based IAM policies alone are sufficient for KMS; the failure is caused by the bucket policy blocking the Glue role, so update the S3 bucket policy instead.

Answer

The KMS key must be a multi-Region key for Glue to write encrypted objects; replicate the key to the job's Region to resolve the error.

Answer

Enable automatic key rotation on the KMS key, because Glue cannot generate data keys against a key that has never been rotated.