SCS-C02 Study Guide: Core Skills & Exam Prep

#1

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-Grade Dispute: 62% 15 comments

#2

Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

S-Grade Dispute: 57% 10 comments

#3

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-Grade Dispute: 55% 5 comments

#4

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-Grade Dispute: 53% 7 comments

#5

Immediately contain a running EC2 by associating a Deny-all NACL with its (sole-occupant) subnet

S-Grade Dispute: 50% 8 comments

#6

Share CloudFormation StackSets from an admin account and use SCPs to block non-compliant provisioning

A-Grade Dispute: 50% 3 comments

#7

CloudWatch agent fails to publish logs because the IAM policy grants cloudwatch: instead of logs:

S-Grade Dispute: 48% 18 comments

#8

Replicate Secrets Manager secrets across Regions with a multi-Region customer managed KMS key

S-Grade Dispute: 46% 15 comments

#9

Encrypt the 2 KB file directly with the aws kms encrypt command

S-Grade Dispute: 44% 5 comments

#10

Mitigate credential stuffing with the WAF ATP rule and a password-reset redirect for affected users

S-Grade Dispute: 44% 6 comments

#11

Verify the security group on the server's ENI and that the instance is registered as an ALB target

A-Grade Dispute: 44% 4 comments

#12

Restore a deleted imported key material by reimporting the same material to decrypt the EBS volume

S-Grade Dispute: 43% 7 comments

#13

Alert on 5 bastion failed logins in 5 minutes via CloudWatch metric-filter alarm and SNS message filtering

S-Grade Dispute: 43% 7 comments

#14

Auto-respond to GuardDuty malware by detaching and tagging EBS then terminating the instance

S-Grade Dispute: 43% 11 comments

#15

Check GuardDuty InstanceCredentialExfiltration findings to confirm EC2 metadata credentials used externally

S-Grade Dispute: 40% 11 comments

#16

Replicate Secrets Manager secrets across Regions with a multi-Region customer managed KMS key

S-Grade Dispute: 40% 7 comments

#17

Troubleshoot a cross-subnet connection failure by inspecting Network ACL DENY rules

S-Grade Dispute: 37% 7 comments

#18

Use ECS Exec to inspect a Fargate container with the least operational effort

S-Grade Dispute: 36% 6 comments

#19

Build a cost-effective DDoS-resilient architecture with Auto Scaling, ELB, and CloudFront+S3

S-Grade Dispute: 35% 15 comments

#20

Remediate Security Hub non-compliance near-real-time via Config rule, Security Hub custom action, and EventBridge-to-Lambda

S-Grade Dispute: 33% 7 comments

#21

Get automated email for exposed IAM access keys via an EventBridge rule on AWS Health Risk events

S-Grade Dispute: 33% 7 comments

#22

Protect HLS CloudFront streams with signed cookies instead of per-chunk signed URLs

S-Grade Dispute: 33% 6 comments

#23

Auto-enroll all org accounts in Security Hub via a delegated admin and a configuration policy on the org root

S-Grade Dispute: 33% 7 comments

#24

Deploy security patches immediately with a 0-day baseline and Patch Now, logging to S3 for evidence

S-Grade Dispute: 30% 8 comments

#25

Pass the current credentials as AWS CLI command-line options for highest precedence without conflict

A-Grade Dispute: 29% 4 comments

#26

Alice can access both buckets because either an IAM or a bucket policy allows each with no explicit deny

S-Grade Dispute: 27% 7 comments

#27

Use GuardDuty RDS Protection with EventBridge and SNS for least-overhead Aurora unknown-user login alerts

S-Grade Dispute: 25% 6 comments

#28

Auto-enable Security Hub for all accounts and aggregate findings across Regions

S-Grade Dispute: 25% 5 comments

#29

Restrict the RDS subnet NACL to PostgreSQL 5432 from the app subnet with ephemeral outbound

S-Grade Dispute: 25% 5 comments

#30

Deploy an org-wide Config aggregator and remediate noncompliant S3 buckets with a Lambda function

A-Grade Dispute: 25% 4 comments

#31

Check file permissions and OS log-rotation compatibility with the CloudWatch Logs agent

A-Grade Dispute: 25% 4 comments

#32

Let the business-unit IAM user assume the top-level account role via an sts:AssumeRole policy

A-Grade Dispute: 25% 4 comments

#33

Block fraudulent foreign sign-ups with a pre-sign-up Lambda trigger and a Cognito WAF geo rule

S-Grade Dispute: 22% 6 comments

#34

Enable GuardDuty EKS Audit Log Monitoring to detect unauthenticated EKS access with least effort

S-Grade Dispute: 20% 5 comments

#35

Capture Cognito auth events in CloudTrail, store in S3, and query with Athena

A-Grade Dispute: 20% 4 comments

#36

Attach a security group to the ALB that allows only inbound port 443

A-Grade Dispute: 20% 4 comments

#37

Use a CloudTrail trail with log file validation and S3 data events for object-level logging

A-Grade Dispute: 20% 3 comments

#38

Use IAM Identity Center with the external IdP and permission sets for scalable multi-account RBAC

S-Grade Dispute: 18% 7 comments

#39

Alert on root console login via a CloudWatch Logs metric-filter alarm and an EventBridge CloudTrail rule

S-Grade Dispute: 17% 5 comments

#40

Use IAM Identity Center with the external IdP and permission sets for org-wide access

S-Grade Dispute: 17% 5 comments

#41

Eliminate post-CreateGrant AccessDenied errors by passing the returned grant token to encrypt calls

S-Grade Dispute: 17% 5 comments

#42

Use Amazon Verified Permissions with Cognito as the identity source for fine-grained authorization

A-Grade Dispute: 17% 4 comments

#43

Fix encrypted-S3 AccessDenied by attaching an inline kms:Decrypt policy to the instance role

S-Grade Dispute: 14% 6 comments

#44

Use Amazon Security Lake to aggregate and normalize organization, Marketplace, and on-prem logs for Athena queries

S-Grade Dispute: 14% 7 comments

#45

Fix CloudTrail-to-S3 delivery by verifying the bucket policy and that the bucket exists

S-Grade Dispute: 14% 9 comments

#46

Write to a cross-account S3 bucket privately using a gateway VPC endpoint

S-Grade Dispute: 12% 6 comments

#47

Rotate a KMS key with imported material by creating a new key, importing new material, and repointing the alias

S-Grade Dispute: 12% 7 comments

#48

Use S3 Object Lock compliance mode with replication to block admin deletion in the DR Region

S-Grade Dispute: 11% 7 comments

#49

Use Amazon Inspector for ECR/ECS vulnerability scanning aggregated to a central Security Hub

S-Grade Dispute: 10% 9 comments

#50

Detect missing software with an AWS Config rule and auto-install via EventBridge, Lambda, and SSM Run Command

S-Grade Dispute: 8% 8 comments

#51

Centralize Security Hub findings via delegated admin, EventBridge to Firehose/S3, and Athena/QuickSight

A-Grade Dispute: 0% 6 comments

#52

Let CLI users satisfy an MFA-required policy with aws sts get-session-token and MFA parameters

A-Grade Dispute: 0% 5 comments

#53

Use per-project S3 Lifecycle expiration after 60 days to purge project data cost-effectively

A-Grade Dispute: 0% 10 comments

#54

Block public access on the bucket and use an SCP to deny disabling Public Access Block

A-Grade Dispute: 0% 6 comments

#55

Encrypt EBS by default with an instance refresh and build an encrypted Aurora cluster from a snapshot

A-Grade Dispute: 0% 5 comments

#56

Use Kinesis for real-time forensic log streaming and OpenSearch Service for persistent log analytics

A-Grade Dispute: 0% 3 comments

#57

Attach an SCP that denies service access to the member-account root user

A-Grade Dispute: 0% 4 comments

#58

Use Systems Manager Patch Manager to find missing patches and automate remediation

A-Grade Dispute: 0% 5 comments

#59

Configure VPC Traffic Mirroring to copy packets to an IDS monitoring instance

A-Grade Dispute: 0% 3 comments

#60

Use an ALB HTTPS listener security policy with a PFS cipher suite

A-Grade Dispute: 0% 3 comments

#61

Use an organizational CloudTrail trail with CloudWatch Logs metric filters and alarms to SNS

A-Grade Dispute: 0% 4 comments

#62

Stream on-prem logs via Kinesis Agent to Firehose, process with Managed Flink, store in OpenSearch

A-Grade Dispute: 0% 4 comments

#63

Replace SSH keys with Systems Manager Session Manager for secure admin access

A-Grade Dispute: 0% 5 comments

#64

Forward logs with the CloudWatch agent to CloudWatch Logs and query with Logs Insights

A-Grade Dispute: 0% 5 comments

#65

Filter CloudTrail for TerminateInstances and review AssumeRoleWithSAML to identify the federated user

A-Grade Dispute: 0% 4 comments

#66

Restore S3 GetObject access by fixing ListBucket, KMS Decrypt, and the gateway-endpoint bucket policy

A-Grade Dispute: 0% 5 comments

#67

Use a KMS key alias and create a new customer managed key on each change

A-Grade Dispute: 0% 4 comments

#68

Use CloudFront OAC plus a bucket policy that allows only the OAC, and a WAF IP-set ACL

A-Grade Dispute: 0% 3 comments

#69

Add an interface VPC endpoint for Secrets Manager

A-Grade Dispute: 0% 3 comments

#70

Deny all outbound at the NACL, isolate with a diagnostics security group, and investigate from a new instance

A-Grade Dispute: 0% 4 comments

#71

Use an AWS Config managed rule with the AWS-EnableCloudTrail remediation to auto re-enable logging

A-Grade Dispute: 0% 5 comments

#72

Set up an Inspector delegated administrator and enable automatic scanning for new member accounts

A-Grade Dispute: 0% 3 comments

#73

Scope the CMK key policy to S3/DynamoDB/Lambda/EKS and deny unencrypted S3/DynamoDB via SCP

A-Grade Dispute: 0% 4 comments

#74

Lambda logs are missing because the execution role lacks CloudWatch Logs write permissions

A-Grade Dispute: 0% 5 comments

#75

Enable IAM Access Analyzer for the organization with a zone of trust and filter by account

A-Grade Dispute: 0% 4 comments

#76

Investigate the exposed key with IAM Access Analyzer and deactivate it to stop further use

A-Grade Dispute: 0% 7 comments

#77

Apply an inbound SNS message data protection policy with the De-identify operation to mask sensitive data

A-Grade Dispute: 0% 3 comments

#78

Deploy the Lambda functions to a private subnet and access S3 through an S3 gateway VPC endpoint

A-Grade Dispute: 0% 3 comments

#79

Edit the root SCP to add a Condition excluding the marketing account from the external-sharing deny

A-Grade Dispute: 0% 3 comments

#80

Migrate game authentication to Amazon Cognito user pools federated with third-party IdPs

A-Grade Dispute: 0% 3 comments

#81

Add an S3 gateway endpoint and a KMS interface endpoint with private DNS in Account B's VPC

A-Grade Dispute: 0% 7 comments

#82

Log script activity in CloudTrail and use IAM Access Analyzer policy generation for least privilege

A-Grade Dispute: 0% 3 comments

#83

Deploy the tokenization code on AWS Nitro Enclaves for an isolated, attestable environment

A-Grade Dispute: 0% 3 comments

#84

Add an aws:MultiFactorAuthPresent condition to the role's trust policy for MFA-gated assumption

A-Grade Dispute: 0% 3 comments

#85

Add a network ACL Deny for the port and source IP to block the suspicious traffic

A-Grade Dispute: 0% 4 comments

#86

Use KMS with imported key material and DeleteImportedKeyMaterial for immediate key removal

A-Grade Dispute: 0% 3 comments

#87

Abort the Glacier vault lock, fix the policy, and initiate the lock again

A-Grade Dispute: 0% 3 comments

#88

Request an ACM certificate, validate via DNS CNAMEs, and attach it to a CloudFront distribution

A-Grade Dispute: 0% 3 comments

#89

Store the SaaS client token as a Parameter Store SecureString and retrieve it in Lambda

A-Grade Dispute: 0% 3 comments

#90

Verify the SQS resource policy does not deny the role and that the role allows queue access

A-Grade Dispute: 0% 3 comments

#91

Use an EventBridge rule on the Config compliance-change event to notify an SNS topic

A-Grade Dispute: 0% 3 comments

#92

Use AWS Service Catalog with CloudFormation and enforce tagging with AWS Config rules

A-Grade Dispute: 0% 3 comments

#93

Verify that the VPC endpoint policy allows access to Amazon S3

A-Grade Dispute: 0% 6 comments

#94

Use an EventBridge rule on root ConsoleLogin events to notify an SNS topic

A-Grade Dispute: 0% 4 comments

#95

Send Secrets Manager events to CloudWatch Logs, add an IncomingBytes metric filter with anomaly detection, and alarm to SNS

A-Grade Dispute: 0% 3 comments

#96

Enable EKS control plane logs and ingest them into CloudWatch for GuardDuty to monitor

A-Grade Dispute: 0% 3 comments

SCS-C02 — Most Debated Topics