AWS SCS-C02 Free Practice Questions — Page 1

Correct Answers: C. Create an IAM role for the Lambda function. Attach an IAM policy that al-lows access to the S3 bucket.; D. Create an IAM role for the Lambda function. Attach a bucket policy to the S3 bucket to allow access. Specify the function's IAM role as the principal.

Why C is correct: Creating an IAM role for the Lambda function and attaching an IAM policy that allows S3 access is the AWS best practice. Lambda functions should use IAM roles (execution roles) rather than embedding credentials. The role is automatically assumed by Lambda at runtime, providing temporary credentials through AWS STS.Why D is correct: This is another valid approach using resource-based policies. You can create an IAM role for Lambda and then use an S3 bucket policy that explicitly allows that role (as the principal) to access the bucket. This demonstrates cross-service authorization using resource-based policies combined with identity-based roles.Why A is wrong: Storing access keys in environment variables is a security anti-pattern. It exposes long-term credentials that could be compromised. AWS explicitly recommends against embedding credentials in code or configuration.Why B is wrong: EC2 key pairs are used for SSH access to EC2 instances, not for AWS API authentication. This answer confuses instance access with service-to-service authentication. Lambda doesn't use SSH keys to communicate with S3.Why E is wrong: Security groups control network traffic (layer 3/4), not API access to S3. S3 access requires IAM permissions, not network security groups. Additionally, Lambda functions in VPC can have security groups, but this doesn't grant S3 API permissions.

Correct Answer: C. Custom SSL certificate that is stored in AWS Certificate Manager (ACM).

Why C is correct: AWS Certificate Manager (ACM) is specifically designed to store and manage SSL/TLS certificates for AWS services. ACM provides free public certificates, handles automatic renewal, and integrates seamlessly with services like CloudFront, Application Load Balancers, and API Gateway. This is the standard AWS solution for SSL/TLS certificate management.Why A is wrong: AWS KMS is designed for encryption key management, not SSL/TLS certificate storage. KMS manages cryptographic keys used for data encryption, but it's not the appropriate service for storing SSL/TLS certificates used for HTTPS connections.Why B is wrong: CloudFront doesn't provide a "default SSL certificate" for custom domains like example.com. CloudFront has a default certificate only for CloudFront distribution domains (*.cloudfront.net), not for custom domains. Custom domains require either ACM certificates or third-party certificates.Why D is wrong: S3 is not designed to store SSL/TLS certificates for use with web services. While you could technically store certificate files in S3, there's no native integration with HTTPS endpoints, and this would not be a secure or functional solution for serving HTTPS traffic.

Correct Answers: A. Gather any relevant metadata for the compromised EC2 instance. Enable termination protection. Isolate the instance by updating the instance's security groups to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing (ELB) resources.; C. Use Systems Manager Run Command to invoke scripts that collect volatile data.; E. Create a snapshot of the compromised EC2 instance's EBS volume for follow-up investigations. Tag the instance with any relevant metadata and incident ticket information.

Why A is correct: This step properly isolates the compromised instance by restricting its security groups, preventing malware spread while keeping the instance running. Enabling termination protection prevents accidental deletion. Detaching from Auto Scaling groups and ELB ensures the instance isn't terminated automatically or receiving traffic, which is critical for forensic investigation. Why C is correct: Using Systems Manager Run Command is the best practice for collecting volatile data (memory, running processes) because it provides a remote, auditable way to execute scripts without direct SSH/RDP access. The activity is logged through CloudTrail, meeting the requirement to capture investigative activity. SSM Agent is already installed per the question. Why E is correct: Creating an EBS snapshot preserves non-volatile storage for forensic analysis. Tagging with metadata and incident information meets the requirement to update the instance's metadata. EBS snapshots are point-in-time backups that can be analyzed separately without affecting the running instance. Why B is wrong: Moving to an isolation subnet that "denies all source and destination traffic" would make the instance completely unreachable, preventing any forensic data collection or investigation. This is too restrictive compared to using security groups to selectively block traffic while allowing investigative access. Why D is wrong: Establishing direct SSH/RDP sessions is not AWS best practice because it doesn't provide the same level of audit logging as Systems Manager Run Command. It also introduces the risk of the investigator's actions contaminating the evidence or altering the volatile state of the system. Why F is wrong: State Manager associations are for ongoing configuration management, not one-time snapshot creation. This adds unnecessary operational overhead compared to simply creating a snapshot directly. State Manager is designed for maintaining desired states across instances, not for incident response.

Correct Answer: B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team's email addresses to the SNS topic. Create custom rules in CloudFormation Guard for each resource configuration. In the CI/CD pipeline, before the build stage, configure a Docker image to run the cfn-guard command on the CloudFormation template. Configure the CI/CD pipeline to publish a notification to the SNS topic if any issues are found.

Why B is correct: CloudFormation Guard is an open-source policy-as-code tool designed specifically to validate CloudFormation templates against security and compliance rules before deployment. Implementing this in the CI/CD pipeline's pre-build stage allows developers to maintain delivery speed while catching non-compliant resources early. Custom rules can enforce the security team's internal standards, and SNS notifications alert the security team only when issues are found. This is operationally efficient because it's automated and doesn't slow down compliant deployments. Why A is wrong: The aws cloudformation validate-template command only checks for valid JSON/YAML syntax and template structure, not compliance with security policies or internal standards. It cannot validate whether resources meet specific security requirements like encryption settings, network configurations, or other compliance controls. Why C is wrong: This solution is operationally inefficient. It requires maintaining EC2 instances, managing SQS queue processing, handling auto-scaling, and creating a separate S3 upload process. This adds significant infrastructure overhead and complexity compared to running validation directly in the CI/CD pipeline. It also slows down delivery since developers must upload templates separately. Why D is wrong: This approach severely limits developer agility by requiring security team review for every new resource or configuration. It creates a bottleneck that contradicts the requirement to "maintain the same overall delivery speed." Centralized templates also don't accommodate the diverse design patterns mentioned (EC2, ELB, RDS, EKS, ECS).

Correct Answers: A. AWS Site-to-Site VPN; B. AWS Direct Connect

Why A is correct: AWS Site-to-Site VPN provides IPsec encryption by default, meeting the encryption requirement. It creates encrypted tunnels over the internet between the on-premises data center and AWS VPC, allowing the application server in AWS to securely communicate with the on-premises database. Why B is correct: AWS Direct Connect provides a dedicated private network connection between on-premises and AWS, which significantly reduces network latency—critical for the latency-sensitive database mentioned in the question. However, Direct Connect alone doesn't provide encryption, so it must be combined with Site-to-Site VPN (VPN over Direct Connect) to meet the IPsec encryption requirement. Why C is wrong: AWS VPN CloudHub is used to provide connectivity between multiple on-premises sites through AWS, using a hub-and-spoke model. It's not designed for connecting AWS workloads to a single on-premises data center. The question describes a simple AWS-to-on-premises connection scenario. Why D is wrong: VPC peering connects two VPCs within AWS, not a VPC to an on-premises data center. It's used for inter-VPC communication within AWS, not for hybrid connectivity. Why E is wrong: NAT gateway provides outbound internet access for resources in private subnets and performs network address translation. It doesn't establish VPN connections or provide encrypted connectivity to on-premises networks. It's purely for internet access, not site-to-site connectivity.