SCS-C02 Exam Questions
470 real SCS-C02 exam questions with expert-verified answers and explanations. Page 1 of 10.
- Question #2Plan and automate identity governance
A company uses AWS Organizations to manage a multi-account AWS environment in a single AWS Region. The organization's management account is named management-01. The company has tur...
AWS Configconformance packmulti-account complianceAWS Organizations - Question #3Implement authentication and access management
A company has a legacy application that runs on a single Amazon EC2 instance. A security audit shows that the application has been using an IAM access key within its code to access...
CloudTrailIAM access keyAthenaS3 audit - Question #4Implement authentication and access management
A security engineer creates an Amazon S3 bucket policy that denies access to all users. A few days later, the security engineer adds an additional statement to the bucket policy to...
IAM policyS3 bucket policyexplicit denypermission evaluation - Question #5Implement authentication and access management
A company is using Amazon Macie, AWS Firewall Manager, Amazon Inspector, and AWS Shield Advanced in its AWS account. The company wants to receive alerts if a DDoS attack occurs aga...
AWS Shield AdvancedDDoS detectionCloudWatch alarmssecurity monitoring - Question #6Plan and implement identity governance
A company has hundreds of AWS accounts in an organization in AWS Organizations. The company operates out of a single AWS Region. The company has a dedicated security tooling AWS ac...
GuardDutySecurity HubVPC DHCPDNS-based findings - Question #7Plan and implement identity governance
An ecommerce company has a web application architecture that runs primarily on containers. The application containers are deployed on Amazon Elastic Container Service (Amazon ECS)....
Amazon InspectorECR scanningcontainer vulnerabilitycontinual scanning - Question #8Plan and implement identity governance
A company has a single AWS account and uses an Amazon EC2 instance to test application code. The company recently discovered that the instance was compromised. The instance was ser...
GuardDutyEventBridgeSNS notificationcontinuous monitoring - Question #9Implement authentication and access management
A company uses identity federation to authenticate users into an identity account (987654321987) where the users assume an IAM role named IdentityRole. The users then assume an IAM...
IAM roleidentity federationcross-account accesstrust policy - Question #10Plan and implement identity governance
A company is using AWS Organizations to manage multiple AWS accounts for its human resources, finance, software development, and production departments. All the company's developer...
AWS Service CatalogEC2 AMIapproved softwareAWS Organizations - Question #11Threat Detection and Incident Response
A company has enabled Amazon GuardDuty in all AWS Regions as part of its security monitoring strategy. In one of its VPCs, the company hosts an Amazon EC2 instance that works as an...
GuardDutysuppression rulesfalse positivesignal-to-noise - Question #12Infrastructure Security
A company is running internal microservices on Amazon Elastic Container Service (Amazon ECS) with the Amazon EC2 launch type. The company is using Amazon Elastic Container Registry...
ECR encryptionKMScontainer scanningCVE detection - Question #13Identity and Access Management
A company's security engineer has been tasked with restricting a contractor's IAM account access to the company's Amazon EC2 console without providing access to any other AWS servi...
IAM permissions boundaryleast privilegecontractor accessEC2 console - Question #14Security Logging and Monitoring
A company manages multiple AWS accounts using AWS Organizations. The company's security team notices that some member accounts are not sending AWS CloudTrail logs to a centralized...
CloudTrailAWS Organizationscentralized loggingorg-wide trail - Question #15Threat Detection and Incident Response
A company recently had a security audit in which the auditors identified multiple potential threats. These potential threats can cause usage pattern changes such as DNS access peak...
GuardDutythreat detectionVPC flow logsDNS logs - Question #16Identity and Access Management
A company that uses AWS Organizations is using AWS IAM Identity Center (AWS Single Sign- On) to administer access to AWS accounts. A security engineer is creating a custom permissi...
IAM Identity Centercustomer managed policypermission setmulti-account - Question #17Data Protection
A company has thousands of AWS Lambda functions. While reviewing the Lambda functions, a security engineer discovers that sensitive information is being stored in environment varia...
Lambdaenvironment variablesParameter Storesecrets management - Question #18Management and Security Governance
A security engineer is using AWS Organizations and wants to optimize SCPs. The security engineer needs to ensure that the SCPs conform to best practices. Which approach should the...
SCPIAM Access Analyzerpolicy validationOrganizations - Question #19Data Protection
A company uses Amazon RDS for MySQL as a database engine for its applications. A recent security audit revealed an RDS instance that is not compliant with company policy for encryp...
RDS encryptionAWS ConfigEBS snapshotdata at rest - Question #20Infrastructure Security
A company has recently recovered from a security incident that required the restoration of Amazon EC2 instances from snapshots. The company uses an AWS Key Management Service (AWS...
EBS snapshotsKMScross-account backupdisaster recovery - Question #21Threat Detection and Incident Response
A company's security engineer is designing an isolation procedure for Amazon EC2 instances as part of an incident response plan. The security engineer needs to isolate a target ins...
EC2 isolationincident responsesecurity groupSystems Manager - Question #22Security Logging and Monitoring
A startup company is using a single AWS account that has resources in a single AWS Region. A security engineer configures an AWS CloudTrail trail in the same Region to deliver log...
CloudTrailmulti-regionS3 loggingtrail configuration - Question #23Infrastructure Security
A company's public Application Load Balancer (ALB) recently experienced a DDoS attack. To mitigate this issue, the company deployed Amazon CloudFront in front of the ALB so that us...
DDoS mitigationCloudFrontALBcustom HTTP header - Question #24Threat Detection and Incident Response
A company discovers a billing anomaly in its AWS account. A security consultant investigates the anomaly and discovers that an employee who left the company 30 days ago still has a...
CloudTrailevent historybilling anomalyaccount investigation - Question #25Data Protection
A security engineer is checking an AWS CloudFormation template for vulnerabilities. The security engineer finds a parameter that has a default value that exposes an application's A...
Secrets ManagerCloudFormationAPI keyplaintext exposure - Question #26Security Logging and Monitoring
A company's AWS CloudTrail logs are all centrally stored in an Amazon S3 bucket. The security team controls the company's AWS account. The security team must prevent unauthorized a...
CloudTraillog integritySSE-KMSS3 bucket policy - Question #27Data Protection
A company has several petabytes of data. The company must preserve this data for 7 years to comply with regulatory requirements. The company's compliance team asks a security offic...
S3 GlacierVault Lockcompliance modedata retention - Question #28Identity and Access Management
A-company uses a third-party identity provider and SAML-based SSO for its AWS accounts. After the third-party identity provider renewed an expired signing certificate, users saw th...
SAMLSSOsigning certificateidentity provider - Question #29Identity and Access Management
A company has several workloads running on AWS. Employees are required to authenticate using on-premises ADFS and SSO to access the AWS Management Console. Developers migrated an e...
ALBAmazon CognitoADFSSSO authentication - Question #30Identity and Access Management
A company has an AWS Lambda function that creates image thumbnails from larger images. The Lambda function needs read and write access to an Amazon S3 bucket in the same AWS accoun...
LambdaIAM roleS3 bucket policyleast privilege - Question #31Infrastructure Security
A security engineer is configuring a new website that is named example.com. The security engineer wants to secure communications with the website by requiring users to connect to e...
- Question #32Incident Response
A security engineer needs to develop a process to investigate and respond to potential security events on a company's Amazon EC2 instances. All the EC2 instances are backed by Amaz...
- Question #33Management and Security Governance
A company has an organization in AWS Organizations. The company wants to use AWS CloudFormation StackSets in the organization to deploy various AWS design patterns into environment...
CloudFormation StackSetsAWS OrganizationsCI/CD pipelineSNS notifications - Question #34Infrastructure Security
A company is migrating one of its legacy systems from an on-premises data center to AWS. The application server will run on AWS, but the database must remain in the on-premises dat...
Site-to-Site VPNDirect ConnectIPsec encryptionhybrid connectivity - Question #35Data Protection
A company has an application that uses dozens of Amazon DynamoDB tables to store data. Auditors find that the tables do not comply with the company's data protection policy. The co...
AWS BackupDynamoDB backupdata retentioncron schedule - Question #36Identity and Access Management
A company needs a security engineer to implement a scalable solution for multi-account authentication and authorization. The solution should not introduce additional user-managed a...
IAM Identity CenterAWS OrganizationsSSOmulti-account authentication - Question #37Threat Detection and Incident Response
A company has deployed Amazon GuardDuty and now wants to implement automation for potential threats. The company has decided to start with RDP brute force attacks that come from Am...
GuardDuty findingsEventBridge automationSecurity Hubincident remediation - Question #38Incident Response
A company has an AWS account that hosts a production application. The company receives an email notification that Amazon GuardDuty has detected an Impact:IAMUser/AnomalousBehavior...
GuardDuty findingsIAM anomalous behaviorincident response playbookread-only investigation - Question #39Identity and Access Management
Company A has an AWS account that is named Account A. Company A recently acquired Company B, which has an AWS account that is named Account B. Company B stores its files in an Amaz...
S3 bucket policycross-account accessIAM permissionsresource-based policy - Question #40Security Logging and Monitoring
A company wants to receive an email notification about critical findings in AWS Security Hub. The company does not have an existing architecture that supports this functionality. W...
Security Hub findingsEventBridge rulesSNS notificationalert automation - Question #41Infrastructure Security
A company needs to implement DNS Security Extensions (DNSSEC) for a specific subdomain. The subdomain is already registered with Amazon Route 53. A security engineer has enabled DN...
DNSSECRoute 53key-signing keyDelegation Signer record - Question #42Infrastructure Security
A company is using Amazon Elastic Container Service (Amazon ECS) to run its container-based application on AWS. The company needs to ensure that the container images contain no sev...
Amazon ECRcontainer vulnerability scanningimage access controlECS security - Question #43Infrastructure Security
A company uses Amazon EC2 Linux instances in the AWS Cloud. A member of the company's security team recently received a report about common vulnerability identifiers on the instanc...
Systems Manager Patch Managervulnerability managementEC2 patchingCVE remediation - Question #44Identity and Access Management
A company has a single-page application (SPA) that is served by Amazon CloudFront. An Amazon S3 bucket is the origin of the CloudFront distribution. The company is using Amazon Cog...
CloudFrontAmazon CognitoLambda@Edgeauthentication enforcement - Question #45Infrastructure Security
A company is migrating its Amazon EC2 based applications to use Instance Metadata Service Version 2 (IMDSv2). A security engineer needs to determine whether any of the EC2 instance...
IMDSv1IMDSv2EC2 metadata serviceCloudWatch metrics - Question #46Data Protection
A company is using HTTPS for all its public endpoints. A third-party certificate authority (CA) issues the certificates. The company imports the certificates and attaches the certi...
AWS Certificate ManagerDNS validationCAA recordscertificate renewal - Question #47Identity and Access Management
A security engineer is designing an IAM policy to protect AWS API operations. The policy must enforce multi-factor authentication (MFA) for IAM users to access certain services in...
IAM policy conditionsMFA enforcementMultiFactorAuthAgesession duration - Question #48Threat Detection and Incident Response
A company uses AWS Organizations and has production workloads across multiple AWS accounts. A security engineer needs to design a solution that will proactively monitor for suspici...
GuardDuty multi-accountcentralized loggingautomated remediationSNS alerts - Question #49Management and Security Governance
A company is designing a multi-account structure for its development teams. The company is using AWS Organizations and AWS IAM Identity Center (AWS Single Sign-On). The company mus...
Service Control PoliciesAWS OrganizationsRegion restrictionsservice allow-listing - Question #50Data Protection
A company is developing an ecommerce application. The application uses Amazon EC2 instances and an Amazon RDS MySQL database. For compliance reasons, data must be secured in transi...
TLS certificatesACMdata in transit encryptionRDS encryption - Question #51Infrastructure Security
A security engineer is working with a company to design an ecommerce application. The application will run on Amazon EC2 instances that run in an Auto Scaling group behind an Appli...
NAT gatewayVPC subnet designALBprivate subnet architecture