SCS-C02 practice questions 1–10

1. Question 1 · 732 in bank

   Select 2

   A company has an AWS Lambda function that creates image thumbnails from larger images. The Lambda function needs read and write access to an Amazon S3 bucket in the same AWS account. Which solutions will provide the Lambda function this access? (Choose two.)

   • ACreate an IAM user that has only programmatic access. Create a new access key pair. Add environmental variables to the Lambda function with the access key ID and secret access key. Modify the Lambda function to use the environmental variables at run time during communication with Amazon S3.
   • BGenerate an Amazon EC2 key pair. Store the private key in AWS Secrets Manager. Modify the Lambda function to retrieve the private key from Secrets Manager and to use the private key during communication with Amazon S3.
   • CCreate an IAM role for the Lambda function. Attach an IAM policy that allows access to the S3 bucket.
   • DCreate an IAM role for the Lambda function. Attach a bucket policy to the S3 bucket to allow access. Specify the function's IAM role as the principal.
   • ECreate a security group. Attach the security group to the Lambda function. Attach a bucket policy that allows access to the S3 bucket through the security group ID.

   Show answer

   Answer: CD

   Explanation

   for sure this will be the use of AWS ROLES it is simple, you attach a role to the lambda to be able to access certain S3 bucket.

   Source: Adapted from community discussion — awssecuritynewbie

   Next question

2. Question 2 · 732 in bank

   The Security team believes that a former employee may have gained unauthorized access to AWS resources sometime in the past 3 months by using an identified access key. What approach would enable the Security team to find out what the former employee may have done within AWS?

   • AUse the AWS CloudTrail console to search for user activity.
   • BUse the Amazon CloudWatch Logs console to filter CloudTrail data by user.
   • CUse AWS Config to see what actions were taken by the user.
   • DUse Amazon Athena to query CloudTrail logs stored in Amazon S3.

   Show answer

   Answer: A

   Next question

3. Question 3 · 732 in bank

   Company A has an AWS account that is named Account A. Company A recently acquired Company B, which has an AWS account that is named Account B. Company B stores its files in an Amazon S3 bucket. The administrators need to give a user from Account A full access to the S3 bucket in Account B. After the administrators adjust the IAM permissions for the user in Account A to access the S3 bucket in Account B, the user still cannot access any files in the S3 bucket. Which solution will resolve this issue?

   • AIn Account B, create a bucket ACL to allow the user from Account A to access the S3 bucket in Account B.
   • BIn Account B, create an object ACL to allow the user from Account A to access all the objects in the S3 bucket in Account B.
   • CIn Account B, create a bucket policy to allow the user from Account A to access the S3 bucket in Account B.
   • DIn Account B, create a user policy to allow the user from Account A to access the S3 bucket in Account B.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

4. Question 4 · 732 in bank

   A company is storing data in Amazon S3 Glacier. The security engineer implemented a new vault lock policy for 10TB of data and called initiate-vault-lock operation 12 hours ago. The audit team identified a typo in the policy that is allowing unintended access to the vault. What is the MOST cost-effective way to correct this?

   • ACall the abort-vault-lock operation. Update the policy. Call the initiate-vault-lock operation again.
   • BCopy the vault data to a new S3 bucket. Delete the vault. Create a new vault with the data.
   • CUpdate the policy to keep the vault lock in place.
   • DUpdate the policy. Call initiate-vault-lock operation again to apply the new policy.

   Show answer

   Answer: A

   Next question

5. Question 5 · 732 in bank

   A company wants to control access to its AWS resources by using identities and groups that are defined in its existing Microsoft Active Directory. What must the company create in its AWS account to map permissions for AWS services to Active Directory user attributes?

   • AAWS IAM groups
   • BAWS IAM users
   • CAWS IAM roles
   • DAWS IAM access keys

   Show answer

   Answer: C

   Next question

6. Question 6 · 732 in bank

   A security engineer wants to use Amazon Simple Notification Service (Amazon SNS) to send email alerts to a company's security team for Amazon GuardDuty findings that have a High severity level. The security engineer also wants to deliver these findings to a visualization tool for further examination. Which solution will meet these requirements?

   • ASet up GuardDuty to send notifications to an Amazon CloudWatch alarm with two targets in CloudWatch. From CloudWatch, stream the findings through Amazon Kinesis Data Streams into an Amazon Open Search Service domain as the first target for delivery. Use Amazon QuickSight to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for the CloudWatch alarm. Use event pattern matching with an Amazon EventBridge event rule to send only High severity findings in the alerts.
   • BSet up GuardDuty to send notifications to AWS CloudTrail with two targets in CloudTrail. From CloudTrail, stream the findings through Amazon Kinesis Data Firehose into an Amazon OpenSearch Service domain as the first target for delivery. Use OpenSearch Dashboards to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for CloudTrail. Use event pattern matching with a CloudTrail event rule to send only High severity findings in the alerts.
   • CSet up GuardDuty to send notifications to Amazon EventBridge with two targets. From EventBridge, stream the findings through Amazon Kinesis Data Firehose into an Amazon OpenSearch Service domain as the first target for delivery. Use OpenSearch Dashboards to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for EventBridge. Use event pattern matching with an EventBridge event rule to send only High severity findings in the alerts.
   • DSet up GuardDuty to send notifications to Amazon EventBridge with two targets. From EventBridge, stream the findings through Amazon Kinesis Data Streams into an Amazon OpenSearch Service domain as the first target for delivery. Use Amazon QuickSight to visualize the findings. Use OpenSearch queries for further analysis. Deliver email alerts to the security team by configuring an SNS topic as a second target for EventBridge. Use event pattern matching with an EventBridge event rule to send only High severity findings in the alerts.

   Show answer

   Answer: C

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 7 · 732 in bank

   Select 3

   A company has contracted with a third party to audit several AWS accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The Auditor is having trouble accessing some of the accounts. Which of the following may be causing this problem? (Choose three.)

   • AThe external ID used by the Auditor is missing or incorrect.
   • BThe Auditor is using the incorrect password.
   • CThe Auditor has not been granted sts:AssumeRole for the role in the destination account.
   • DThe Amazon EC2 role used by the Auditor must be set to the destination account role.
   • EThe secret key used by the Auditor is missing or incorrect.
   • FThe role ARN used by the Auditor is missing or incorrect.

   Show answer

   Answer: ACF

   Next question

8. Question 8 · 732 in bank

   A security engineer needs to implement a write-once-read-many (WORM) model for data that a company will store in Amazon S3 buckets. The company uses the S3 Standard storage class for all of its S3 buckets. The security engineer must ensure that objects cannot be overwritten or deleted by any user, including the AWS account root user. Which solution will meet these requirements?

   • ACreate new S3 buckets with S3 Object Lock enabled in compliance mode. Place objects in the S3 buckets.
   • BUse S3 Glacier Vault Lock to attach a Vault Lock policy to new S3 buckets. Wait 24 hours to complete the Vault Lock process. Place objects in the S3 buckets.
   • CCreate new S3 buckets with S3 Object Lock enabled in governance mode. Place objects in the S3 buckets.
   • DCreate new S3 buckets with S3 Object Lock enabled in governance mode. Add a legal hold to the S3 buckets. Place objects in the S3 buckets.

   Show answer

   Answer: A

   Explanation

   In compliance mode, a protected object version can't be overwritten or deleted by any user, including the root user in your AWS account. When an object is locked in compliance mode, its retention mode can't be changed, and its retention period can't be shortened. Compliance mode helps ensure that an object version can't be overwritten or deleted for the duration of the retention period. In governance mode, users can't overwrite or delete an object version or alter its lock settings unless they have special permissions. With governance mode, you protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings or delete the objects if necessary. You can also use governance mode to test retention-period settings before creating a compliance-mode retention period.

   Source: Adapted from community discussion — confusedyeti69

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 9 · 732 in bank

   Compliance requirements state that all communications between company on-premises hosts and EC2 instances be encrypted in transit. Hosts use custom proprietary protocols for their communication, and EC2 instances need to be fronted by a load balancer for increased availability. Which of the following solutions will meet these requirements?

   • AOffload SSL termination onto an SSL listener on a Classic Load Balancer, and use a TCP connection between the load balancer and the EC2 instances.
   • BRoute all traffic through a TCP listener on a Classic Load Balancer, and terminate the TLS connection on the EC2 instances.
   • CCreate an HTTPS listener using an Application Load Balancer, and route all of the communication through that load balancer.
   • DOffload SSL termination onto an SSL listener using an Application Load Balancer, and re-spawn and SSL connection between the load balancer and the EC2 instances.

   Show answer

   Answer: B

   Next question

10. Question 10 · 732 in bank

    A company needs complete encryption of the traffic between external users and an application. The company hosts the application on a fleet of Amazon EC2 instances that run in an Auto Scaling group behind an Application Load Balancer (ALB). How can a security engineer meet these requirements?

    • ACreate a new Amazon-issued certificate in AWS Secrets Manager. Export the certificate from Secrets Manager. Import the certificate into the ALB and the EC2 instances.
    • BCreate a new Amazon-issued certificate in AWS Certificate Manager (ACM). Associate the certificate with the ALExport the certificate from ACM. Install the certificate on the EC2 instances.
    • CImport a new third-party certificate into AWS Identity and Access Management (IAM). Export the certificate from IAM. Associate the certificate with the ALB and the EC2 instances.
    • DImport a new third-party certificate into AWS Certificate Manager (ACM). Associate the certificate with the ALB. Install the certificate on the EC2 instances.

    Show answer

    Answer: D

    Explanation

    Because of the wording of this question, I did not first know which of the options B and D is correct. However, my conviction that you can't directly install Amazon-issued certificates on EC2 instances (refer to - https://repost.aws/knowledge-center/associate-acm-certificate-alb-nlb for more information) made me to study a few documentations to be sure D is the correct answer. Please check the Accepted answer in the following thread - https://repost.aws/questions/QUIo7PWvZ3T6aFYCByhZ5f0A/load-certificate-on-alb-and-ec2

    Source: Adapted from community discussion — AgboolaKun

    References

    • repost.aws documentation
    • repost.aws documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 1. 732 questions available.