SCS-C02 practice questions 111–120

1. Question 111 · 732 in bank

   Select 2

   Amazon CloudWatch Logs agent is successfully delivering logs to the CloudWatch Logs service. However, logs stop being delivered after the associated log stream has been active for a specific number of hours. What steps are necessary to identify the cause of this phenomenon? (Choose two.)

   • AEnsure that file permissions for monitored files that allow the CloudWatch Logs agent to read the file have not been modified.
   • BVerify that the OS Log rotation rules are compatible with the configuration requirements for agent streaming.
   • CConfigure an Amazon Kinesis producer to first put the logs into Amazon Kinesis Streams.
   • DCreate a CloudWatch Logs metric to isolate a value that changes at least once during the period before logging stops.
   • EUse AWS CloudFormation to dynamically create and maintain the configuration file for the CloudWatch Logs agent.

   Show answer

   Answer: AB

   Next question

2. Question 112 · 732 in bank

   Select 2

   A company in France uses Amazon Cognito with the Cognito Hosted UI as an identity broker for sign-in and sign-up processes. The company is marketing an application and expects that all the application’s users will come from France. When the company launches the application, the company’s security team observes fraudulent sign-ups for the application. Most of the fraudulent registrations are from users outside of France. The security team needs a solution to perform custom validation at sign-up. Based on the results of the validation, the solution must accept or deny the registration request. Which combination of steps will meet these requirements? (Choose two.)

   • ACreate a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool.
   • BUse a geographic match rule statement to configure an AWS WAF web ACL Associate the web ACL with the Amazon Cognito user pool.
   • CConfigure an app client for the application's Amazon Cognito user pool. Use the app client ID to validate the requests in the hosted UI.
   • DUpdate the application’s Amazon Cognito user pool to configure a geographic restriction setting.
   • EUse Amazon Cognito to configure a social identity provider (IdP) to validate the requests on the hosted UI.

   Show answer

   Answer: AB

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 113 · 732 in bank

   A company has deployed a custom DNS server in AWS. The Security Engineer wants to ensure that Amazon EC2 instances cannot use the Amazon-provided DNS. How can the Security Engineer block access to the Amazon-provided DNS in the VPC?

   • ADeny access to the Amazon DNS IP within all security groups.
   • BAdd a rule to all network access control lists that deny access to the Amazon DNS IP.
   • CAdd a route to all route tables that black holes traffic to the Amazon DNS IP.
   • DDisable DNS resolution within the VPC configuration.

   Show answer

   Answer: D

   Next question

4. Question 114 · 732 in bank

   Select 2

   A security engineer is configuring AWS Config for an AWS account that uses a new IAM entity. When the security engineer tries to configure AWS Config rules and automatic remediation options, errors occur. In the AWS CloudTrail logs, the security engineer sees the following error message: “Insufficient delivery policy to s3 bucket: DOC-EXAMPLE-BUCKET, unable to write to bucket, provided s3 key prefix is ‘null’.” Which combination of steps should the security engineer take to remediate this issue? (Choose two.)

   • ACheck the Amazon S3 bucket policy. Verify that the policy allows the config amazonaws,com service to write to the target bucket.
   • BVerify that the IAM entity has the permissions necessary to perform the s3:GetBucketAcl and s3:PutObject* operations to write to the target bucket.
   • CVerify that the Amazon S3 bucket policy has the permissions necessary to perform the s3:GetBucketAcl and s3:PutObject* operations to write to the target bucket.
   • DCheck the policy that is associated with the IAM entity. Verify that the policy allows the config.amazonaws.com service to write to the target bucket.
   • EVerify that the AWS Config service role has permissions to invoke the BatchGetResourceConfig action instead of the GetResourceConfigHistory action and s3:PutObject* operation.

   Show answer

   Answer: AB

   References

   • repost.aws documentation

   Next question

5. Question 115 · 732 in bank

   Select 2

   An employee accidentally exposed an AWS access key and secret access key during a public presentation. The company Security Engineer immediately disabled the key. How can the Engineer assess the impact of the key exposure and ensure that the credentials were not misused? (Choose two.)

   • AAnalyze AWS CloudTrail for activity.
   • BAnalyze Amazon CloudWatch Logs for activity.
   • CDownload and analyze the IAM Use report from AWS Trusted Advisor.
   • DAnalyze the resource inventory in AWS Config for IAM user activity.
   • EDownload and analyze a credential report from IAM.

   Show answer

   Answer: AE

   Next question

6. Question 116 · 732 in bank

   Select 3

   A company is undergoing a layer 3 and layer 4 DDoS attack on its web servers running on AWS. Which combination of AWS services and features will provide protection in this scenario? (Choose three.)

   • AAmazon Route 53
   • BAWS Certificate Manager (ACM)
   • CAmazon S3
   • DAWS Shield
   • ENetwork Load Balancer
   • FAmazon GuardDuty

   Show answer

   Answer: ADE

   Explanation

   Answer A, D, E A. Amazon Route 53. --> Reduce attack Surface B. AWS Certificate Manager (ACM) --> Not relevant DDoS C. Amazon S3 --> Not relevant DDoS D. AWS Shield --> Service for DDoS E. Elastic Load Balancer --> Increase Availability F. Amazon GuardDuty --> Not relevant for DDoS

   Source: Adapted from community discussion — aescudero51

   Next question

7. Question 117 · 732 in bank

   Which of the following minimizes the potential attack surface for applications?

   • AUse security groups to provide stateful firewalls for Amazon EC2 instances at the hypervisor level.
   • BUse network ACLs to provide stateful firewalls at the VPC level to prevent access to any specific AWS resource.
   • CUse AWS Direct Connect for secure trusted connections between EC2 instances within private subnets.
   • DDesign network security in a single layer within the perimeter network (also known as DMZ, demilitarized zone, and screened subnet) to facilitate quicker responses to threats.

   Show answer

   Answer: A

   Next question

8. Question 118 · 732 in bank

   A company wants to implement host-based security for Amazon EC2 instances and containers in Amazon Elastic Container Registry (Amazon ECR). The company has deployed AWS Systems Manager Agent (SSM Agent) on the EC2 instances. All the company's AWS accounts are in one organization in AWS Organizations. The company will analyze the workloads for software vulnerabilities and unintended network exposure. The company will push any findings to AWS Security Hub, which the company has configured for the organization. The company must deploy the solution to all member accounts, including new accounts, automatically. When new workloads come online, the solution must scan the workloads. Which solution will meet these requirements?

   • AUse SCPs to configure scanning of EC2 instances and ECR containers for all accounts in the organization.
   • BConfigure a delegated administrator for Amazon GuardDuty for the organization. Create an Amazon EventBridge rule to initiate analysis of ECR containers
   • CConfigure a delegated administrator for Amazon Inspector for the organization. Configure automatic scanning for new member accounts.
   • DConfigure a delegated administrator for Amazon Inspector for the organization. Create an AWS Config rule to initiate analysis of ECR containers.

   Show answer

   Answer: C

   Explanation

   Host-based security for EC2 instances: Amazon Inspector is specifically designed for vulnerability scanning of Amazon EC2 instances. Container security for ECR: Inspector also supports scanning container images stored in Amazon ECR. Automatic deployment to all accounts: Configuring a delegated administrator for Inspector in the organization ensures automatic deployment of the scanning agent to all member accounts, including new ones. Automatic scanning for new workloads: Enabling automatic scanning for new member accounts guarantees that any new EC2 instances or container images launched will be automatically scanned by Inspector.

   Source: Adapted from community discussion — aescudero51

   References

   • AWS documentation

   Next question

9. Question 119 · 732 in bank

   A distributed web application is installed across several EC2 instances in public subnets residing in two Availability Zones. Apache logs show several intermittent brute-force attacks from hundreds of IP addresses at the layer 7 level over the past six months. What would be the BEST way to reduce the potential impact of these attacks in the future?

   • AUse custom route tables to prevent malicious traffic from routing to the instances.
   • BUpdate security groups to deny traffic from the originating source IP addresses.
   • CUse network ACLs.
   • DInstall intrusion prevention software (IPS) on each instance.

   Show answer

   Answer: D

   Next question

10. Question 120 · 732 in bank

    A company uses AWS Organizations to manage several AWS accounts. The company processes a large volume of sensitive data. The company uses a serverless approach to microservices. The company stores all the data in either Amazon S3 or Amazon DynamoDB. The company reads the data by using either AWS Lambda functions or container-based services that the company hosts on Amazon Elastic Kubernetes Service (Amazon EKS) on AWS Fargate. The company must implement a solution to encrypt all the data at rest and enforce least privilege data access controls. The company creates an AWS Key Management Service (AWS KMS) customer managed key. What should the company do next to meet these requirements?

    • ACreate a key policy that allows the kms:Decrypt action only for Amazon S3 and DynamoDB. Create an SCP that denies the creation of S3 buckets and DynamoDB tables that are not encrypted with the key.
    • BCreate an IAM policy that denies the kms:Decrypt action for the key. Create a Lambda function than runs on a schedule to attach the policy to any new roles. Create an AWS Config rule to send alerts for resources that are not encrypted with the key.
    • CCreate a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB, Lambda, and Amazon EKS. Create an SCP that denies the creation of S3 buckets and DynamoDB tables that are not encrypted with the key.
    • DCreate a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB, Lambda, and Amazon EKS. Create an AWS Config rule to send alerts for resources that are not encrypted with the key.

    Show answer

    Answer: C

    Explanation

    Answer is C because: 1. Allowing the kms:Decrypt action only for the specified services, enforcing encryption. 2. Creating an SCP to deny the creation of any unencrypted S3 buckets and DynamoDB tables. This approach ensures that all sensitive data is encrypted at rest using the customer-managed key, while still allowing the necessary access to the specified AWS services.

    Source: Adapted from community discussion — heatblur

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 111. 732 questions available.