ISC2 Systems Security Certified Practitioner (SSCP) Practice Test

AWS Security Hub includes built-in security standards such as the CIS AWS Foundations Benchmark and PCI DSS. When enabled across multiple accounts and Regions, it continuously runs automated configuration checks by using AWS Config rules, aggregates the results centrally, and displays each control's compliance status in a single dashboard. Security Hub can also integrate natively with Amazon EventBridge to route findings to ticketing or SOAR systems, enabling remediation workflows without extensive custom development.

AWS Config conformance packs can evaluate resources against specific rules, but they do not provide the same cross-account, multi-Region aggregation, prebuilt PCI reporting, or native finding forwarding features. AWS Trusted Advisor offers best-practice checks but does not map results directly to compliance standards or aggregate findings across accounts. AWS Artifact supplies downloadable audit reports and agreements but does not perform continuous technical checks of your environment.

A tabletop exercise is a facilitated discussion, so designating an impartial facilitator is essential. The facilitator keeps the scenario on schedule, prompts participation from every role, and steers the conversation toward the predefined objectives. Pre-reads are helpful but do not ensure focus, a red-team engagement is a different test type, and avoiding documentation defeats one of the main benefits-capturing lessons learned for future improvement.

Segregation of duties is achieved by ensuring that the person who creates or changes code cannot by themselves place that code into production. Inserting a Manual Approval action in AWS CodePipeline and assigning that action's permissions to a separate IAM role reserved for release managers cleanly separates build and deployment responsibilities. Options that give developers AdministratorAccess, rely solely on peer review, use one shared role with MFA, or depend only on detective controls such as CloudTrail and GuardDuty do not provide the required preventative separation because developers would still be able to deploy or there would be no enforcing control at the deployment gate.

A distributed denial-of-service (DDoS) attack attempts to exhaust a target's compute or network capacity by overwhelming it with a flood of traffic from many geographically dispersed sources. The sudden spike to 150 000 requests per minute, the large number of different source IP addresses, and the resulting resource exhaustion and service outages precisely match DDoS characteristics.

An insider threat would typically involve actions taken with legitimate, internal credentials and would not require traffic from thousands of external IPs. A zero-day exploit focuses on taking advantage of an unknown software vulnerability to gain unauthorized access or execute code; it does not inherently generate massive, distributed traffic surges. An advanced persistent threat (APT) relies on stealth and persistence to exfiltrate data over time and deliberately avoids causing noticeable service disruption. Therefore, the observed symptoms most closely align with a DDoS attack.

The RMF Monitor step requires ongoing control assessments and timely risk reporting. AWS Config conformance packs continuously evaluate resource configurations against predefined rule sets, while AWS Security Hub consumes the resulting findings, correlates them with other AWS service detections, and displays consolidated compliance scores mapped to frameworks such as NIST CSF, PCI DSS, and CIS. This combination delivers the automated, centralized monitoring expected by the RMF. CloudTrail with S3 logs, GuardDuty alone, or Macie alone provide valuable security data but do not automatically compare configurations against control baselines or generate framework-aligned compliance reports.

AWS CloudTrail is the detective control designed to record every API call made within an AWS account. A multi-region, organization-wide trail delivered to an S3 bucket preserves log files well beyond 90 days and captures details such as the IAM identity that made the call, the source IP address, request parameters, and response elements. VPC Flow Logs only capture network flow metadata and cannot show who invoked a change to a security group. AWS Config records resource configuration states and can trigger alerts, but it does not include the full caller identity or originating IP for every API call. Amazon GuardDuty generates threat-detection findings from several data sources; while useful, it does not provide a complete, immutable log of every API operation. Therefore, enabling AWS CloudTrail with centralized S3 storage best meets the stated detective-control requirement.

A deterrent control discourages inappropriate behavior by reminding potential violators of monitoring or penalties, rather than physically preventing or detecting actions. Displaying a log-on warning banner (for both the AWS Management Console and SSH sessions) clearly informs users that their actions are tracked and that misuse has legal consequences, which can discourage unauthorized activity.

• Implementing MFA or network ACLs are preventive controls because they block access unless specific conditions are met.
• Enabling CloudTrail with SNS alerts is primarily a detective and corrective measure, identifying and responding to events after they occur.
  Therefore, only a prominently displayed log-on warning banner fulfills the stated compliance need for a deterrent control.

Amazon S3 Object Lock lets you place objects in a write-once-read-many (WORM) state. Enabling Object Lock in Compliance mode means no user, not even the root account, can modify or delete protected objects until the retention period or legal hold is cleared, meeting strict litigation-hold and eDiscovery requirements. Adding a legal hold flag allows indefinite protection without setting a retention expiry. Merely suspending lifecycle policies or relying on versioning still allows privileged users to delete object versions, violating preservation obligations. Copying data on-premises and deleting it from S3 breaks chain-of-custody and complicates discovery. An IAM deny statement prevents deletes but cannot block overwrites and is reversible by an administrator, so it lacks the immutability assurances required for legal holds.

Disabling encryption would lower the confidentiality of customer PII and jeopardize the public's trust in the organization's services. The first (ISC)² Code of Ethics canon requires members to protect society, the commonwealth, and the infrastructure; the second demands they act legally and responsibly. Simply obeying, even with logging, still violates these canons, while enabling extra monitoring after removing encryption does not mitigate the fundamental risk. The most ethical course is to refuse the insecure request and offer an alternative that preserves encryption yet meets business objectives, such as using temporary performance tuning or parallel encrypted buckets.

The Code of Ethics mandates protecting society and the public, acting honorably, honestly, justly, responsibly, and legally, and providing diligent service to principals. Sharing customer data without written consent would violate contractual and legal obligations and jeopardize confidentiality, so the request must be refused. The incident should be promptly reported or escalated through the organization's compliance or management channels. Encrypting, partially anonymizing, or sharing to a personal account still constitutes unauthorized disclosure and does not satisfy the canons.

Security policies are administrative controls that communicate management's intent and expectations. They are concise, high-level statements that describe allowed and prohibited activities, set overall direction, and assign authority. Policies do not contain the granular how-to steps found in procedures, the numeric thresholds found in standards or baselines, or constantly changing asset inventories. Therefore, focusing the Cloud Acceptable Use Policy on broad directives that define acceptable and unacceptable behavior is the correct approach, while the other options describe content better suited for supporting documents such as procedures, standards, or operational inventories.

Availability is concerned with ensuring that authorized users have timely and reliable access to systems and data. Placing EC2 instances in multiple Availability Zones and enabling health-check-based Auto Scaling provides redundancy and automatic failover, so the service continues to operate if one instance or an entire AZ becomes unavailable. Requiring TLS 1.2 protects data in transit and supports confidentiality and integrity, not availability. AWS WAF rules mitigate common web attacks, contributing primarily to integrity and confidentiality. Storing CloudTrail logs with Object Lock supports accountability and non-repudiation rather than keeping the API reachable. Therefore, distributing resources across AZs with automatic recovery is the option that best fulfills the availability objective.

Vishing relies on spoofed Caller ID and social engineering to trick victims into revealing sensitive information or performing actions such as password resets. The most effective user-level countermeasure is to teach employees to independently verify any unsolicited support request. Hanging up and dialing the official help-desk number published on the company intranet or ID badge forces attackers to lose control of the channel and prevents them from exploiting spoofed numbers. Asking callers to send an SMS does not guarantee authenticity, since SMS can also be spoofed. Carrier spam-call blocking reduces nuisance calls but cannot stop targeted spoofed numbers. Refusing all non-internal calls would hinder business operations and is impractical. Therefore, instructing users to perform a trusted call-back is the best balance of security and usability.

Non-repudiation requires evidence that an action was performed by a specific principal and that the evidence cannot be altered without detection. Enabling AWS CloudTrail captures every API call together with the caller's identity and signs each log file with a SHA-256 hash and public-key signature. Turning on CloudTrail's log file integrity validation lets you verify that logs have not been modified, while S3 versioning and MFA Delete protect the evidence from tampering or deletion. AWS WAF and Shield improve availability but do not bind actions to identities. Server-side encryption and Object Lock secure stored objects but do not record who performed an action or provide cryptographic validation of logs. Replicating data in DynamoDB enhances durability and availability, not non-repudiation.

Running IAM Access Analyzer shows exactly which external AWS principals would gain access if the new bucket policy is applied, allowing the SSCP to compare the resulting access with the bucket's data classification and least-privilege requirements. Performance testing, cost estimates, and tagging may be useful for other evaluations, but they do not directly reveal the security implications of expanded cross-account access, making them less pertinent to the impact analysis.

AWS Config continuously records the configuration state of supported AWS resources, stores historical snapshots for as long as you choose, and evaluates each change against rules or conformance packs that map to organizational or regulatory requirements. This enables auditors to verify that resources remained compliant (or to see exactly when they drifted) throughout the requested 12-month period.

• CloudTrail records API calls but not the resulting resource configurations and retains only 90 days of event history by default.
• GuardDuty focuses on threat detection and does not perform configuration compliance checks.
• CloudWatch Logs ingests log data but does not automatically track or evaluate resource configurations. Therefore, AWS Config with conformance packs is the most appropriate choice.

Amazon S3 Glacier Deep Archive is AWS's lowest-cost storage class for long-term retention. When combined with S3 Object Lock in compliance mode, each object is placed in a write-once, read-many (WORM) state that cannot be altered or deleted until the retention period expires, meeting immutability requirements. Server-side encryption with KMS keys ensures that data remains encrypted at rest. Standard retrieval from Glacier Deep Archive is typically available within 12 hours, which satisfies the audit retrieval window at minimal cost.

Storing data on encrypted EBS volumes, even if snapshots are taken, does not provide WORM protection and incurs higher ongoing storage costs. Keeping data in S3 Standard with versioning is far more expensive over seven years and versioning alone does not prevent tampering. AWS Backup warm storage offers longer retention, but it is priced higher than Glacier Deep Archive and does not inherently enforce object-level immutability. Therefore, the Glacier Deep Archive solution with Object Lock and KMS encryption is the only option that addresses all security, cost, and retrieval requirements.

Integrating an automated static application security testing (SAST) stage in the CodeBuild phase implements the principle of "shift-left" security central to DevSecOps. Because the scan runs on every pull request, defects are identified before code is merged or deployed, when they are cheapest and easiest to fix. Quarterly penetration tests may uncover issues, but only long after vulnerable code is in production and at a higher cost. Manual reviews after deployment detect problems late, rely on human availability, and do not scale. A web application firewall protects running workloads but does nothing to stop insecure code from being introduced during development.

Using Amazon S3 Object Lock in Compliance mode places every log object in a write-once, read-many (WORM) state; no one, including the root user, can delete or alter the object until the retention date passes. A lifecycle rule can still move the objects to a colder, less expensive storage class such as S3 Glacier Instant Retrieval after 30 days, reducing cost while leaving the WORM protection in place for the full 400-day period. Versioning alone cannot stop a privileged user from permanently deleting all versions, AWS Backup for S3 does not protect the original objects from deletion, and moving the data to EFS introduces higher cost and lacks WORM protection. Therefore, enabling Object Lock in Compliance mode with an appropriate retention period and adding a transition rule provides both immutability and cost efficiency.

The requirement focuses on preventing unauthorized disclosure of customer tax records, which maps directly to the security objective of confidentiality. Integrity addresses protection against unauthorized modification, availability concerns timely and reliable access, and non-repudiation provides proof of origin or delivery. Because the scenario tolerates some corruption and slow retrieval but does not tolerate exposure to unauthorized parties, confidentiality is the key objective.