Disagreement ranking

SCS-C02 — most debated topics

Community-voted ranking of 96 topics, sorted by disagreement level. A higher dispute score means more test-takers disagree on the answer.

Full ranking

96 topics · highest disagreement first

  1. Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

    S-grade Dispute: 62% 15 comments

  2. Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

    S-grade Dispute: 57% 10 comments

  3. Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

    S-grade Dispute: 55% 5 comments

  4. Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

    S-grade Dispute: 53% 7 comments

  5. Immediately contain a running EC2 by associating a Deny-all NACL with its (sole-occupant) subnet

    S-grade Dispute: 50% 8 comments

  6. Share CloudFormation StackSets from an admin account and use SCPs to block non-compliant provisioning

    A-grade Dispute: 50% 3 comments

  7. CloudWatch agent fails to publish logs because the IAM policy grants cloudwatch: instead of logs:

    S-grade Dispute: 48% 18 comments

  8. Replicate Secrets Manager secrets across Regions with a multi-Region customer managed KMS key

    S-grade Dispute: 46% 15 comments

  9. Encrypt the 2 KB file directly with the aws kms encrypt command

    S-grade Dispute: 44% 5 comments

  10. Mitigate credential stuffing with the WAF ATP rule and a password-reset redirect for affected users

    S-grade Dispute: 44% 6 comments

  11. Verify the security group on the server's ENI and that the instance is registered as an ALB target

    A-grade Dispute: 44% 4 comments

  12. Restore a deleted imported key material by reimporting the same material to decrypt the EBS volume

    S-grade Dispute: 43% 7 comments

  13. Alert on 5 bastion failed logins in 5 minutes via CloudWatch metric-filter alarm and SNS message filtering

    S-grade Dispute: 43% 7 comments

  14. Auto-respond to GuardDuty malware by detaching and tagging EBS then terminating the instance

    S-grade Dispute: 43% 11 comments

  15. Check GuardDuty InstanceCredentialExfiltration findings to confirm EC2 metadata credentials used externally

    S-grade Dispute: 40% 11 comments

  16. Replicate Secrets Manager secrets across Regions with a multi-Region customer managed KMS key

    S-grade Dispute: 40% 7 comments

  17. Troubleshoot a cross-subnet connection failure by inspecting Network ACL DENY rules

    S-grade Dispute: 37% 7 comments

  18. Use ECS Exec to inspect a Fargate container with the least operational effort

    S-grade Dispute: 36% 6 comments

  19. Build a cost-effective DDoS-resilient architecture with Auto Scaling, ELB, and CloudFront+S3

    S-grade Dispute: 35% 15 comments

  20. Remediate Security Hub non-compliance near-real-time via Config rule, Security Hub custom action, and EventBridge-to-Lambda

    S-grade Dispute: 33% 7 comments

  21. Get automated email for exposed IAM access keys via an EventBridge rule on AWS Health Risk events

    S-grade Dispute: 33% 7 comments

  22. Protect HLS CloudFront streams with signed cookies instead of per-chunk signed URLs

    S-grade Dispute: 33% 6 comments

  23. Auto-enroll all org accounts in Security Hub via a delegated admin and a configuration policy on the org root

    S-grade Dispute: 33% 7 comments

  24. Deploy security patches immediately with a 0-day baseline and Patch Now, logging to S3 for evidence

    S-grade Dispute: 30% 8 comments

  25. Pass the current credentials as AWS CLI command-line options for highest precedence without conflict

    A-grade Dispute: 29% 4 comments

  26. Alice can access both buckets because either an IAM or a bucket policy allows each with no explicit deny

    S-grade Dispute: 27% 7 comments

  27. Use GuardDuty RDS Protection with EventBridge and SNS for least-overhead Aurora unknown-user login alerts

    S-grade Dispute: 25% 6 comments

  28. Auto-enable Security Hub for all accounts and aggregate findings across Regions

    S-grade Dispute: 25% 5 comments

  29. Restrict the RDS subnet NACL to PostgreSQL 5432 from the app subnet with ephemeral outbound

    S-grade Dispute: 25% 5 comments

  30. Deploy an org-wide Config aggregator and remediate noncompliant S3 buckets with a Lambda function

    A-grade Dispute: 25% 4 comments

  31. Check file permissions and OS log-rotation compatibility with the CloudWatch Logs agent

    A-grade Dispute: 25% 4 comments

  32. Let the business-unit IAM user assume the top-level account role via an sts:AssumeRole policy

    A-grade Dispute: 25% 4 comments

  33. Block fraudulent foreign sign-ups with a pre-sign-up Lambda trigger and a Cognito WAF geo rule

    S-grade Dispute: 22% 6 comments

  34. Enable GuardDuty EKS Audit Log Monitoring to detect unauthenticated EKS access with least effort

    S-grade Dispute: 20% 5 comments

  35. Capture Cognito auth events in CloudTrail, store in S3, and query with Athena

    A-grade Dispute: 20% 4 comments

  36. Attach a security group to the ALB that allows only inbound port 443

    A-grade Dispute: 20% 4 comments

  37. Use a CloudTrail trail with log file validation and S3 data events for object-level logging

    A-grade Dispute: 20% 3 comments

  38. Use IAM Identity Center with the external IdP and permission sets for scalable multi-account RBAC

    S-grade Dispute: 18% 7 comments

  39. Alert on root console login via a CloudWatch Logs metric-filter alarm and an EventBridge CloudTrail rule

    S-grade Dispute: 17% 5 comments

  40. Use IAM Identity Center with the external IdP and permission sets for org-wide access

    S-grade Dispute: 17% 5 comments

  41. Eliminate post-CreateGrant AccessDenied errors by passing the returned grant token to encrypt calls

    S-grade Dispute: 17% 5 comments

  42. Use Amazon Verified Permissions with Cognito as the identity source for fine-grained authorization

    A-grade Dispute: 17% 4 comments

  43. Fix encrypted-S3 AccessDenied by attaching an inline kms:Decrypt policy to the instance role

    S-grade Dispute: 14% 6 comments

  44. Use Amazon Security Lake to aggregate and normalize organization, Marketplace, and on-prem logs for Athena queries

    S-grade Dispute: 14% 7 comments

  45. Fix CloudTrail-to-S3 delivery by verifying the bucket policy and that the bucket exists

    S-grade Dispute: 14% 9 comments

  46. Write to a cross-account S3 bucket privately using a gateway VPC endpoint

    S-grade Dispute: 12% 6 comments

  47. Rotate a KMS key with imported material by creating a new key, importing new material, and repointing the alias

    S-grade Dispute: 12% 7 comments

  48. Use S3 Object Lock compliance mode with replication to block admin deletion in the DR Region

    S-grade Dispute: 11% 7 comments

  49. Use Amazon Inspector for ECR/ECS vulnerability scanning aggregated to a central Security Hub

    S-grade Dispute: 10% 9 comments

  50. Detect missing software with an AWS Config rule and auto-install via EventBridge, Lambda, and SSM Run Command

    S-grade Dispute: 8% 8 comments

  51. Centralize Security Hub findings via delegated admin, EventBridge to Firehose/S3, and Athena/QuickSight

    A-grade Dispute: 0% 6 comments

  52. Let CLI users satisfy an MFA-required policy with aws sts get-session-token and MFA parameters

    A-grade Dispute: 0% 5 comments

  53. Use per-project S3 Lifecycle expiration after 60 days to purge project data cost-effectively

    A-grade Dispute: 0% 10 comments

  54. Block public access on the bucket and use an SCP to deny disabling Public Access Block

    A-grade Dispute: 0% 6 comments

  55. Encrypt EBS by default with an instance refresh and build an encrypted Aurora cluster from a snapshot

    A-grade Dispute: 0% 5 comments

  56. Use Kinesis for real-time forensic log streaming and OpenSearch Service for persistent log analytics

    A-grade Dispute: 0% 3 comments

  57. Attach an SCP that denies service access to the member-account root user

    A-grade Dispute: 0% 4 comments

  58. Use Systems Manager Patch Manager to find missing patches and automate remediation

    A-grade Dispute: 0% 5 comments

  59. Configure VPC Traffic Mirroring to copy packets to an IDS monitoring instance

    A-grade Dispute: 0% 3 comments

  60. Use an ALB HTTPS listener security policy with a PFS cipher suite

    A-grade Dispute: 0% 3 comments

  61. Use an organizational CloudTrail trail with CloudWatch Logs metric filters and alarms to SNS

    A-grade Dispute: 0% 4 comments

  62. Stream on-prem logs via Kinesis Agent to Firehose, process with Managed Flink, store in OpenSearch

    A-grade Dispute: 0% 4 comments

  63. Replace SSH keys with Systems Manager Session Manager for secure admin access

    A-grade Dispute: 0% 5 comments

  64. Forward logs with the CloudWatch agent to CloudWatch Logs and query with Logs Insights

    A-grade Dispute: 0% 5 comments

  65. Filter CloudTrail for TerminateInstances and review AssumeRoleWithSAML to identify the federated user

    A-grade Dispute: 0% 4 comments

  66. Restore S3 GetObject access by fixing ListBucket, KMS Decrypt, and the gateway-endpoint bucket policy

    A-grade Dispute: 0% 5 comments

  67. Use a KMS key alias and create a new customer managed key on each change

    A-grade Dispute: 0% 4 comments

  68. Use CloudFront OAC plus a bucket policy that allows only the OAC, and a WAF IP-set ACL

    A-grade Dispute: 0% 3 comments

  69. Add an interface VPC endpoint for Secrets Manager

    A-grade Dispute: 0% 3 comments

  70. Deny all outbound at the NACL, isolate with a diagnostics security group, and investigate from a new instance

    A-grade Dispute: 0% 4 comments

  71. Use an AWS Config managed rule with the AWS-EnableCloudTrail remediation to auto re-enable logging

    A-grade Dispute: 0% 5 comments

  72. Set up an Inspector delegated administrator and enable automatic scanning for new member accounts

    A-grade Dispute: 0% 3 comments

  73. Scope the CMK key policy to S3/DynamoDB/Lambda/EKS and deny unencrypted S3/DynamoDB via SCP

    A-grade Dispute: 0% 4 comments

  74. Lambda logs are missing because the execution role lacks CloudWatch Logs write permissions

    A-grade Dispute: 0% 5 comments

  75. Enable IAM Access Analyzer for the organization with a zone of trust and filter by account

    A-grade Dispute: 0% 4 comments

  76. Investigate the exposed key with IAM Access Analyzer and deactivate it to stop further use

    A-grade Dispute: 0% 7 comments

  77. Apply an inbound SNS message data protection policy with the De-identify operation to mask sensitive data

    A-grade Dispute: 0% 3 comments

  78. Deploy the Lambda functions to a private subnet and access S3 through an S3 gateway VPC endpoint

    A-grade Dispute: 0% 3 comments

  79. Edit the root SCP to add a Condition excluding the marketing account from the external-sharing deny

    A-grade Dispute: 0% 3 comments

  80. Migrate game authentication to Amazon Cognito user pools federated with third-party IdPs

    A-grade Dispute: 0% 3 comments

  81. Add an S3 gateway endpoint and a KMS interface endpoint with private DNS in Account B's VPC

    A-grade Dispute: 0% 7 comments

  82. Log script activity in CloudTrail and use IAM Access Analyzer policy generation for least privilege

    A-grade Dispute: 0% 3 comments

  83. Deploy the tokenization code on AWS Nitro Enclaves for an isolated, attestable environment

    A-grade Dispute: 0% 3 comments

  84. Add an aws:MultiFactorAuthPresent condition to the role's trust policy for MFA-gated assumption

    A-grade Dispute: 0% 3 comments

  85. Add a network ACL Deny for the port and source IP to block the suspicious traffic

    A-grade Dispute: 0% 4 comments

  86. Use KMS with imported key material and DeleteImportedKeyMaterial for immediate key removal

    A-grade Dispute: 0% 3 comments

  87. Abort the Glacier vault lock, fix the policy, and initiate the lock again

    A-grade Dispute: 0% 3 comments

  88. Request an ACM certificate, validate via DNS CNAMEs, and attach it to a CloudFront distribution

    A-grade Dispute: 0% 3 comments

  89. Store the SaaS client token as a Parameter Store SecureString and retrieve it in Lambda

    A-grade Dispute: 0% 3 comments

  90. Verify the SQS resource policy does not deny the role and that the role allows queue access

    A-grade Dispute: 0% 3 comments

  91. Use an EventBridge rule on the Config compliance-change event to notify an SNS topic

    A-grade Dispute: 0% 3 comments

  92. Use AWS Service Catalog with CloudFormation and enforce tagging with AWS Config rules

    A-grade Dispute: 0% 3 comments

  93. Verify that the VPC endpoint policy allows access to Amazon S3

    A-grade Dispute: 0% 6 comments

  94. Use an EventBridge rule on root ConsoleLogin events to notify an SNS topic

    A-grade Dispute: 0% 4 comments

  95. Send Secrets Manager events to CloudWatch Logs, add an IncomingBytes metric filter with anomaly detection, and alarm to SNS

    A-grade Dispute: 0% 3 comments

  96. Enable EKS control plane logs and ingest them into CloudWatch for GuardDuty to monitor

    A-grade Dispute: 0% 3 comments

← Back to SCS-C02 Study Guide