Medium — SCS-C02 Practice Quiz

Question 1

A security team runs a public-facing web application behind an Application Load Balancer (ALB) that terminates TLS using a certificate provisioned by AWS Certificate Manager (ACM). A PCI DSS audit requires that the application no longer negotiate TLS 1.0 or TLS 1.1 and must reject weak ciphers, while still supporting modern browsers. What is the MOST appropriate action to enforce this requirement?

Accepted Answer

Update the HTTPS listener on the ALB to use a predefined ELB security policy that only permits TLS 1.2 and above.

Answer

Reissue the ACM certificate with a stronger key algorithm so that older TLS versions are automatically disabled.

Answer

Attach an AWS WAF rule to the ALB that inspects the TLS handshake and blocks connections using TLS 1.0 or 1.1.

Answer

Enable AWS Config managed rules to detect and automatically remediate the certificate's supported protocol versions.

Question 2

A media company hosts a static website in an S3 bucket served through a CloudFront distribution. The web team, which operates primarily in the eu-west-1 Region, requests an ACM certificate for their custom domain so that the distribution can serve HTTPS traffic. They created a public certificate in ACM in eu-west-1, validated it via DNS, and confirmed its status is 'Issued'. However, the certificate does not appear as a selectable option when they attempt to associate it with the CloudFront distribution. What is the cause and correct remediation?

Accepted Answer

CloudFront only supports certificates that are stored in ACM in the us-east-1 (N. Virginia) Region; request or import the certificate in us-east-1 and associate it with the distribution.

Answer

The certificate must be exported from ACM and manually uploaded to CloudFront, because CloudFront cannot reference ACM-managed certificates directly.

Answer

CloudFront requires certificates issued by AWS Private CA rather than public ACM certificates; reissue the certificate using a private CA.

Answer

The certificate's DNS validation must be redone using email validation, because CloudFront ignores DNS-validated ACM certificates.

Question 3

A company runs a public-facing application behind an Application Load Balancer. The security team uses an SSL/TLS certificate that was issued by the company's existing third-party certificate authority and then imported into AWS Certificate Manager (ACM). During an audit, the team is concerned about a repeat of a past incident where the certificate expired and caused an outage. Which approach ensures they are proactively warned before this imported certificate expires?

Accepted Answer

Use the ACM-provided Amazon CloudWatch metric 'DaysToExpiry' and configure a CloudWatch alarm (or an EventBridge rule for the ACM expiration event) to notify the team before expiry.

Answer

Rely on ACM to automatically renew the imported certificate 60 days before expiration, as it does for all certificates in ACM.

Answer

Enable AWS Config managed rule 'acm-certificate-rsa-check' to force renewal of the imported certificate automatically.

Answer

Migrate the certificate's private key into AWS Secrets Manager and enable automatic rotation to replace the certificate before it expires.

Question 4

A company runs a public-facing REST API behind an Application Load Balancer (ALB). Security requires that the TLS private key used to terminate connections is never exportable or accessible to administrators, and that certificate renewal happens automatically without operator intervention. The team currently uses a certificate issued by a public third-party certificate authority that they trust. Which approach best meets all requirements?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM) for the domain and associate it with the ALB listener, allowing ACM to manage the private key and renewal.

Answer

Import the existing third-party certificate and private key into ACM and associate it with the ALB, relying on ACM to rotate the key automatically.

Answer

Store the third-party private key in AWS Secrets Manager, enable automatic rotation, and reference the secret from the ALB listener configuration.

Answer

Upload the certificate and private key to IAM as a server certificate and attach it to the ALB, using IAM access policies to prevent administrators from reading the key.

Question 5

A financial services company runs a fleet of internal microservices on EC2 instances behind internal Application Load Balancers within a private VPC. Security policy requires mutual TLS between all internal services using X.509 certificates issued by a certificate authority the company controls. The certificates must be short-lived and automatically renewed, and the CA's root must NOT be publicly trusted. Which solution best meets these requirements?

Accepted Answer

Deploy AWS Private CA (ACM Private CA) as the internal root/subordinate hierarchy, issue certificates through ACM for the ALBs, and distribute the private CA root to services for trust validation.

Answer

Use AWS Certificate Manager (ACM) public certificates for each service and configure the internal ALBs to require client certificates.

Answer

Store self-signed certificates in AWS Secrets Manager and configure a Lambda rotation function to replace them every 24 hours on each service.

Answer

Purchase certificates from a third-party public CA and import them into ACM, then attach them to the internal ALBs for mutual TLS.

Question 6

A security engineer stores several years of CloudTrail logs in an S3 bucket organized by the standard prefix pattern (AWSLogs//CloudTrail/////). Analysts run frequent Athena queries filtered to a specific account, region, and date range, but queries are slow and scan far more data than expected, driving up cost. The engineer wants to reduce data scanned and query time without running a crawler or manually adding partitions each day. Which approach best meets these requirements?

Accepted Answer

Enable partition projection on the Athena table by defining partition keys (region, date) with projection type and ranges in the table properties so partitions are calculated at query time.

Answer

Convert all existing CloudTrail JSON logs to a single uncompressed CSV file and re-create the Athena table pointing at it.

Answer

Schedule an AWS Glue crawler to run every hour to discover and register new partitions in the Data Catalog.

Answer

Increase the Athena query result location storage class to S3 Intelligent-Tiering to lower scan costs.

Question 7

A healthcare company operates a public web application behind CloudFront and an Application Load Balancer. A form collects patients' credit card numbers and Social Security numbers. Compliance requires that these specific fields remain encrypted from the moment they enter the AWS edge, so that even the application servers and downstream microservices cannot read them — only a dedicated payment processing service holding a private key may decrypt them. The rest of the request must remain readable for normal application processing. Which CloudFront capability meets this requirement with the least change to backend components?

Accepted Answer

Enable CloudFront field-level encryption with a public key configuration so the specified sensitive fields are encrypted at the edge before forwarding to the origin.

Answer

Attach an AWS WAF web ACL to the distribution with a rule that masks the sensitive form fields before they reach the origin.

Answer

Require HTTPS between the viewer and CloudFront and between CloudFront and the origin using a custom ACM certificate to protect the fields in transit.

Answer

Use a CloudFront Function on the viewer request event to hash the sensitive fields with SHA-256 before they are forwarded to the ALB.

Question 8

A media company streams licensed video content through Amazon CloudFront. Licensing agreements require that content be accessible only from viewers in Canada and the United States. Additionally, the security team wants to block a specific list of malicious IP addresses regardless of their geographic origin, and they want both controls applied at the edge with the lowest possible latency and cost. Which combination of controls should the security engineer implement?

Accepted Answer

Use CloudFront geographic restrictions (geo-blocking) to allow only Canada and the US, and associate an AWS WAF web ACL with an IP set rule to block the malicious IPs

Answer

Use AWS WAF geo-match rules to allow only Canada and the US, and configure security groups on the origin to block the malicious IP addresses

Answer

Use CloudFront geographic restrictions for both the country allow-list and the malicious IP blocking, since geo-restriction supports CIDR deny lists

Answer

Use a Lambda@Edge function to inspect the CloudFront-Viewer-Country header and the source IP, rejecting requests that do not match policy

Question 9

A company serves static content from a private S3 bucket through a CloudFront distribution. Security review reveals that the S3 objects can still be downloaded directly using their public S3 URLs, bypassing CloudFront (and its attached WAF web ACL). The team must ensure content is only reachable through CloudFront while following current AWS best practices. What should they implement?

Accepted Answer

Configure an Origin Access Control (OAC) on the CloudFront origin and update the S3 bucket policy to allow only the distribution's service principal, while keeping public access blocked.

Answer

Enable S3 Block Public Access on the bucket and rely on CloudFront's default behavior to make direct object access impossible.

Answer

Attach the WAF web ACL directly to the S3 bucket so the same Layer 7 rules are enforced regardless of access path.

Answer

Make the S3 bucket public and add a bucket policy that only allows requests originating from CloudFront edge location IP ranges.

Question 10

A media company serves video thumbnails and metadata through CloudFront backed by an Application Load Balancer in a single AWS Region. During viral traffic spikes, they observe that origin request volume overwhelms the ALB even though most objects are cacheable, because CloudFront has many regional edge caches making independent requests to the origin on cache misses. The security team also wants to minimize the origin's exposure to direct request bursts. Which CloudFront configuration change most directly reduces redundant origin fetches and consolidates requests to the origin?

Accepted Answer

Enable CloudFront Origin Shield in the Region closest to the origin so cache misses are consolidated through a single additional caching layer

Answer

Attach an AWS WAF rate-based rule to the CloudFront distribution to throttle requests before they reach the origin

Answer

Increase the default TTL to the maximum and rely on regional edge caches to independently serve traffic without contacting the origin

Answer

Replace the ALB origin with an Origin Access Control configuration to authenticate all origin requests

Question 11

A media company stores premium video files in an S3 bucket and serves them to paying subscribers through a CloudFront distribution. The security team requires that each video link works only for a specific authenticated subscriber and automatically stops working after 6 hours. Direct S3 access must remain blocked, and links must not be shareable in a way that grants indefinite access. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable CloudFront signed URLs with a time-limited expiration policy, and use Origin Access Control (OAC) so the S3 bucket only accepts requests from the distribution.

Answer

Attach an AWS WAF web ACL to the distribution with a rate-based rule that limits each subscriber to a fixed number of requests per 6 hours.

Answer

Enable S3 presigned URLs generated by the application and point subscribers directly to the S3 object URLs instead of using CloudFront.

Answer

Configure a CloudFront geo-restriction allow list and require subscribers to log in through Cognito before each playback session.

Question 12

A security engineer configured a CloudTrail trail to deliver events to a CloudWatch Logs log group so that metric filters and alarms can be created. Events are successfully delivered to the S3 bucket, but no log streams or events are appearing in the CloudWatch Logs log group. The trail shows no obvious errors in the console. What is the MOST likely cause?

Accepted Answer

The IAM role that CloudTrail assumes to write to CloudWatch Logs lacks the logs:CreateLogStream and logs:PutLogEvents permissions for the target log group

Answer

The CloudWatch Logs log group retention period is set too low, causing events to be deleted before they can be viewed

Answer

The S3 bucket policy is missing the required s3:GetBucketAcl permission for the CloudTrail service principal

Answer

Data events are not enabled on the trail, so no management events are forwarded to CloudWatch Logs

Question 13

A security engineer configured an organization trail in CloudTrail to log all management events to a central S3 bucket. During an investigation, the team notices that API calls made in the us-west-2 region for a member account are appearing in the logs, but Amazon S3 object-level GetObject and PutObject calls made against buckets in that account are completely absent from the delivered log files. The trail is confirmed to be logging and delivering files successfully. What is the MOST likely reason the S3 object-level activity is missing?

Accepted Answer

The trail is only configured to log management events; data events for S3 must be explicitly enabled on the trail.

Answer

S3 object-level operations are only captured by VPC Flow Logs, not by CloudTrail.

Answer

The organization trail does not apply to member accounts, so their S3 activity is never recorded.

Answer

CloudTrail log file integrity validation stripped the S3 object-level events because they failed digest verification.

Question 14

A security team must be alerted within seconds whenever any IAM policy is attached to a user, group, or role across a single account. They already have an organization CloudTrail delivering management events to an S3 bucket and to a CloudWatch Logs log group. The team wants the lowest-latency, most operationally efficient way to trigger an SNS notification when these specific API calls occur. Which approach best meets the requirement?

Accepted Answer

Create an EventBridge rule that matches the AttachUserPolicy, AttachGroupPolicy, and AttachRolePolicy CloudTrail events and targets an SNS topic.

Answer

Create a CloudWatch Logs metric filter on the log group for the policy-attach events, publish a metric, and configure a CloudWatch alarm that notifies SNS.

Answer

Schedule an Athena query every minute against the CloudTrail S3 bucket and send results to SNS when matches are found.

Answer

Enable CloudTrail Insights to detect the policy-attach events and route Insights findings to SNS.

Question 15

A security team wants to detect unusual patterns in API call volume and error rates across their AWS account, such as a sudden spike in IAM policy modifications or an unusual burst of TerminateInstances calls that could indicate compromised credentials. They already have a management events trail enabled but no automated way to surface anomalous behavior. They do not want to build and maintain custom baselining logic or manually tune CloudWatch metric filters for every API. Which approach best meets this requirement with the least operational overhead?

Accepted Answer

Enable CloudTrail Insights events on the existing trail to automatically detect and log unusual write API call rate and error rate activity.

Answer

Create CloudWatch Logs metric filters for every sensitive API action and configure alarms with static thresholds for each one.

Answer

Schedule an Athena query against the CloudTrail S3 bucket every hour and compare call counts against manually maintained baselines.

Answer

Enable CloudTrail data events for all resources and route them to a Lambda function that computes rolling averages of API call rates.

Question 16

A security team must run ad hoc SQL queries against 18 months of CloudTrail management events to investigate historical API activity. Currently, CloudTrail delivers logs to an S3 bucket, and the team queries them using Athena. However, they find that maintaining Athena table partitions and re-running the AWS Glue crawler as new log prefixes arrive is error-prone, and some queries return incomplete results because partitions were not updated. The team wants a managed solution that requires no partition management and lets them query events with SQL for up to 7 years. Which approach best meets these requirements with the least ongoing maintenance?

Accepted Answer

Create a CloudTrail Lake event data store with an extended retention period and run SQL queries directly against it.

Answer

Enable Athena partition projection on the existing CloudTrail table and configure a longer S3 lifecycle retention.

Answer

Send CloudTrail logs to CloudWatch Logs and use CloudWatch Logs Insights to query the 18-month history.

Answer

Schedule a daily AWS Glue crawler run via EventBridge to keep the Athena partitions current and store logs in S3 Glacier.

Question 17

A security analyst configured a multi-Region CloudTrail trail delivering management events to an S3 bucket. During an incident investigation, they notice that an API call known to have occurred at 14:02 UTC does not appear in the S3 bucket when they check at 14:08 UTC. The trail is enabled, the S3 bucket policy is correct, and log file validation shows no gaps once files arrive. What is the MOST likely explanation, and what should the analyst do?

Accepted Answer

CloudTrail typically delivers log files to S3 within about 15 minutes of an API call; the analyst should wait and recheck, as this delay is expected behavior.

Answer

The trail is missing an SNS notification configuration, which is required before any events can be written to S3.

Answer

Management events are not captured by default and must be explicitly enabled with a data event selector before they appear in the bucket.

Answer

The event was a global service event that is only delivered to the trail's home Region bucket prefix, so it will never appear in a multi-Region trail.

Question 18

A security engineer must prove to auditors that CloudTrail log files stored in an S3 bucket have not been modified or deleted since delivery. The organization already has a multi-Region trail delivering logs to a dedicated central logging account. During a compliance review, the auditors ask for a mechanism that can cryptographically verify whether any log file was altered or removed after CloudTrail wrote it. Which approach satisfies this requirement?

Accepted Answer

Enable CloudTrail log file integrity validation and use the digest files with the AWS CLI validate-logs command to verify the hashes.

Answer

Enable S3 server-side encryption with SSE-KMS on the log bucket so tampering is prevented by encryption.

Answer

Turn on S3 Versioning and MFA Delete on the log bucket to detect and block modifications.

Answer

Configure AWS Config to record configuration changes to the S3 bucket and alert on any object-level modifications.

Question 19

A company has 40 accounts in AWS Organizations. The security team wants to guarantee that management events from every existing and future member account are captured in a single, tamper-evident location, without requiring administrators in each account to create or maintain their own trails. Which approach BEST meets these requirements with the least ongoing operational overhead?

Accepted Answer

Create an organization trail from the management account that delivers logs to a centralized S3 bucket, and enable log file validation.

Answer

Provide a CloudFormation StackSet that deploys an individual account-level trail in each member account, delivering to a local S3 bucket.

Answer

Enable CloudTrail Insights in each member account and forward findings to a central Security Hub aggregator.

Answer

Configure AWS Config in all accounts and use an aggregator to record management API activity in the management account.

Question 20

A security engineer configures a new CloudTrail trail to deliver logs to a centralized S3 bucket in a dedicated logging account. The trail is created successfully in the source account, but no log files ever appear in the destination bucket. CloudTrail shows no delivery errors in the console for the first few hours. The bucket has default SSE-S3 encryption enabled and a bucket policy that was recently modified to add a condition requiring the aws:SecureTransport key. What is the MOST likely cause of the missing log files?

Accepted Answer

The S3 bucket policy does not grant the CloudTrail service principal (cloudtrail.amazonaws.com) the s3:PutObject and s3:GetBucketAcl permissions required to write log files.

Answer

CloudTrail cannot deliver logs to an S3 bucket that uses SSE-S3 encryption; the bucket must use SSE-KMS with a key policy granting CloudTrail access.

Answer

Cross-account log delivery from a source account to a logging account is not supported by CloudTrail and requires an organization trail instead.

Answer

The aws:SecureTransport condition blocks CloudTrail because the service delivers logs over unencrypted HTTP connections.

Question 21

A security engineer needs to prove which IAM principals read individual objects from a highly sensitive S3 bucket named 'legal-contracts'. After enabling a multi-region CloudTrail trail, the engineer notices that GetObject and PutObject API calls for the bucket do not appear in the CloudTrail logs, although CreateBucket and PutBucketPolicy calls are present. What is the correct action to capture the required object-level activity?

Accepted Answer

Configure S3 data events in the CloudTrail trail, scoped to the 'legal-contracts' bucket, and specify read and write event types.

Answer

Enable S3 server access logging on the 'legal-contracts' bucket and deliver logs to CloudTrail.

Answer

Enable CloudTrail Insights events on the trail to automatically detect object-level anomalies.

Answer

Turn on VPC Flow Logs for the subnet where the S3 gateway endpoint resides to record object access.

Question 22

A security engineer configured a multi-Region CloudTrail trail to deliver logs to an S3 bucket and created an Athena table pointing to the bucket prefix. After several days, queries against the Athena table return zero rows even though the S3 bucket contains many CloudTrail log object files under the correct prefix. The engineer confirms the trail is active and logs are being written. What is the MOST likely cause of the empty query results?

Accepted Answer

The Athena table's LOCATION or partition definitions do not match the actual S3 key path (account ID, Region, and date structure) where CloudTrail writes the objects.

Answer

CloudTrail log file integrity validation is enabled, which prevents Athena from reading the compressed log objects.

Answer

The trail is not configured to log management events, so the delivered objects contain no queryable records.

Answer

S3 server-side encryption with SSE-S3 blocks Athena from decrypting the CloudTrail objects at query time.

Question 23

A security engineer must centralize application logs from a fleet of Amazon Linux 2 EC2 instances into CloudWatch Logs so that a metric filter can trigger alarms on repeated authentication failures. After installing and starting the unified CloudWatch agent on the instances, the engineer confirms the agent process is running, but no log groups or log events appear in CloudWatch Logs. The agent configuration file correctly references the application log file path. What is the MOST likely cause of the missing logs?

Accepted Answer

The EC2 instance profile (IAM role attached to the instances) lacks the logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents permissions.

Answer

CloudWatch Logs does not support ingestion from EC2 instances unless a VPC interface endpoint is created for the CloudTrail service.

Answer

The metric filter must be created before the agent starts, otherwise CloudWatch discards incoming log events.

Answer

Log data must first be delivered to an S3 bucket, and CloudWatch Logs subscriptions pull the events from S3 automatically.

Question 24

A security operations team receives dozens of CloudWatch alarm notifications each night for a fleet of EC2 instances. Individual metric alarms fire for high CPU, high memory, and low disk space, but the team only wants to be paged when an instance shows signs of genuine distress — specifically when CPU is high AND disk space is low at the same time. They want to reduce noise without deleting the existing metric alarms, which feed other dashboards. What is the MOST appropriate approach?

Accepted Answer

Create a CloudWatch composite alarm that references the existing CPU and disk-space metric alarms with an ALARM(cpu) AND ALARM(disk) rule, and send notifications only from the composite alarm.

Answer

Delete the individual metric alarms and create a single metric math alarm that adds CPU and disk metrics together, alarming when the sum crosses a threshold.

Answer

Configure an SNS filter policy on the existing alarm topic so subscribers only receive messages when two alarms publish within the same minute.

Answer

Increase the evaluation period and datapoints-to-alarm on each individual metric alarm so they fire less frequently overnight.

Question 25

A security team operates a centralized logging account. They need application VPC Flow Logs and CloudWatch Logs from 40 member accounts to be continuously streamed in near real time to a central Amazon OpenSearch Service domain in the logging account for correlation and dashboards. The solution must scale to high log volume, require minimal per-account maintenance, and avoid custom polling code. Which approach best meets these requirements?

Accepted Answer

In each member account, create a CloudWatch Logs subscription filter that sends log events to a cross-account Amazon Kinesis Data Firehose delivery stream (via a destination in the logging account) configured to deliver to the central OpenSearch domain.

Answer

Schedule a Lambda function in each member account to call GetLogEvents every minute and PutRecord the results into an S3 bucket in the logging account, then load them into OpenSearch nightly.

Answer

Enable CloudWatch Logs export tasks in every member account to export log groups to the central S3 bucket on a recurring basis, then index the objects with an OpenSearch ingestion pipeline.

Answer

Configure AWS Config aggregators in the logging account to collect the log data from all member accounts and forward it to OpenSearch through EventBridge.