SCS-C02 practice questions 131–140

1. Question 131 · 732 in bank

   Select 2

   An application has been built with Amazon EC2 instances that retrieve messages from Amazon SQS. Recently, IAM changes were made and the instances can no longer retrieve messages. What actions should be taken to troubleshoot the issue while maintaining least privilege? (Choose two.)

   • AConfigure and assign an MFA device to the role used by the instances.
   • BVerify that the SQS resource policy does not explicitly deny access to the role used by the instances.
   • CVerify that the access key attached to the role used by the instances is active.
   • DAttach the AmazonSQSFullAccess managed policy to the role used by the instances.
   • EVerify that the role attached to the instances contains policies that allow access to the queue.

   Show answer

   Answer: BE

   Next question

2. Question 132 · 732 in bank

   A company is developing an ecommerce application. The application uses Amazon EC2 instances and an Amazon RDS MySQL database. For compliance reasons, data must be secured in transit and at rest. The company needs a solution that minimizes operational overhead and minimizes cost. Which solution meets these requirements?

   • AUse TLS certificates from AWS Certificate Manager (ACM) with an Application Load Balancer. Deploy self-signed certificates on the EC2 instances. Ensure that the database client software uses a TLS connection to Amazon RDS. Enable encryption of the RDS DB instance. Enable encryption on the Amazon Elastic Block Store (Amazon EBS) volumes that support the EC2 instances.
   • BUse TLS certificates from a third-party vendor with an Application Load Balancer. Install the same certificates on the EC2 instances. Ensure that the database client software uses a TLS connection to Amazon RDS. Use AWS Secrets Manager for client-side encryption of application data.
   • CUse AWS CloudHSM to generate TLS certificates for the EC2 instances. Install the TLS certificates on the EC2 instances. Ensure that the database client software uses a TLS connection to Amazon RDS. Use the encryption keys from CloudHSM for client-side encryption of application data.
   • DUse Amazon CloudFront with AWS WAF. Send HTTP connections to the origin EC2 instances. Ensure that the database client software uses a TLS connection to Amazon RDS. Use AWS Key Management Service (AWS KMS) for client-side encryption of application data before the data is stored in the RDS database.

   Show answer

   Answer: A

   Explanation

   Only A address data encryption at rest at RDS and EBS and is the most cost-effective and efficient method. TLS certificates from a third-party vendor or generated by CloudHSM is unnecessarily increase cost and ops overhead. CloudFront with WAF is irrelevant to the requirement.

   Source: Adapted from community discussion — Daniel76

   Next question

3. Question 133 · 732 in bank

   Select 2

   A company has a forensic logging use case whereby several hundred applications running on Docker on EC2 need to send logs to a central location. The Security Engineer must create a logging solution that is able to perform real-time analytics on the log files, grants the ability to replay events, and persists data. Which AWS Services, together, can satisfy this use case? (Choose two.)

   • AAmazon Elasticsearch
   • BAmazon Kinesis
   • CAmazon SQS
   • DAmazon CloudWatch
   • EAmazon Athena

   Show answer

   Answer: AB

   Next question

4. Question 134 · 732 in bank

   A company needs to create a centralized solution to analyze log files. The company uses an organization in AWS Organizations to manage its AWS accounts. The solution must aggregate and normalize events from the following sources: • The entire organization in Organizations • All AWS Marketplace offerings that run in the company’s AWS accounts • The company's on-premises systems Which solution will meet these requirements?

   • AConfigure a centralized Amazon S3 bucket for the logs. Enable VPC Flow Logs, AWS CloudTrail. and Amazon Route 53 logs in all accounts. Configure all accounts to use the centralized S3 bucket. Configure AWS Glue crawlers to parse the log files. Use Amazon Athena to query the log data.
   • BConfigure log streams in Amazon CloudWatch Logs for the sources that need monitoring Create log subscription filters for each log stream. Forward the messages to Amazon OpenSearch Service for analysis.
   • CSet up a delegated Amazon Security Lake administrator account in Organizations. Enable and configure Security Lake for the organization. Add the accounts that need monitoring. Use Amazon Athena to query the log data.
   • DApply an SCP to configure all member accounts and services to deliver log files to a centralized Amazon S3 bucket. Use Amazon OpenSearch Service to query the centralized S3 bucket for log entries.

   Show answer

   Answer: C

   Explanation

   Amazon Security Lake is designed to automatically collect, normalize, and store security-related data across AWS accounts and on-premises systems. Security Lake can be set up in a delegated administrator account within AWS Organizations, allowing centralized management and configuration across all accounts in the organization. Amazon Athena can be used to query and analyze the log data stored in Security Lake, providing a powerful and flexible way to gain insights from the aggregated logs. Using Amazon Security Lake provides a streamlined and integrated approach to centralized log management across your entire AWS organization and on-premises systems, making it the most effective and efficient solution for your needs.

   Source: Adapted from community discussion — nischal77777

   References

   • AWS documentation

   Next question

5. Question 135 · 732 in bank

   Which of the following is the most efficient way to automate the encryption of AWS CloudTrail logs using a Customer Master Key (CMK) in AWS KMS?

   • AUse the KMS direct encrypt function on the log data every time a CloudTrail log is generated.
   • BUse the default Amazon S3 server-side encryption with S3-managed keys to encrypt and decrypt the CloudTrail logs.
   • CConfigure CloudTrail to use server-side encryption using KMS-managed keys to encrypt and decrypt CloudTrail logs.
   • DUse encrypted API endpoints so that all AWS API calls generate encrypted CloudTrail log entries using the TLS certificate from the encrypted API call.

   Show answer

   Answer: C

   Next question

6. Question 136 · 732 in bank

   A company uses AWS Organizations. The company has more than 100 AWS accounts and will increase the number of accounts. The company also uses an external corporate identity provider (IdP). The company needs to provide users with role-based access to the accounts. The solution must maximize scalability and operational efficiency. Which solution will meet these requirements?

   • AIn each account, create a set of dedicated IAM users. Ensure that all users assume these IAM users through federation with the existing IdP.
   • BDeploy an IAM role in a central identity account. Allow users to assume the role through federation with the existing IdP. In each account, deploy a set of IAM roles that match the desired access patterns. Include a trust policy that allows access from the central identity account. Edit the permissions policy for the role in each account to match user access requirements.
   • CEnable AWS IAM Identity Center. Integrate IAM Identity Center with the company's existing IdP. Create permission sets that match the desired access patterns. Assign permissions to match user access requirements.
   • DIn each account, deploy a set of IAM roles that match the desired access patterns. Create a trust policy with the existing IdP. Update each role's permissions policy to use SAML-based IAM condition keys that are based on user access requirements.

   Show answer

   Answer: C

   Explanation

   This solution provides centralized management, reducing operational overhead. IAM Identity Center (AWS Single Sign-On) scales easily across multiple accounts and integrates well with external IdPs. It allows for centralized creation and management of permission sets, ensuring efficient and secure role-based access.

   Source: Adapted from community discussion — RaniaSaeedB

   Next question

7. Question 137 · 732 in bank

   An organization is using AWS CloudTrail, Amazon CloudWatch Logs, and Amazon CloudWatch to send alerts when new access keys are created. However, the alerts are no longer appearing in the Security Operations mail box. Which of the following actions would resolve this issue?

   • AIn CloudTrail, verify that the trail logging bucket has a log prefix configured.
   • BIn Amazon SNS, determine whether the ג€Account spend limitג€ has been reached for this alert.
   • CIn SNS, ensure that the subscription used by these alerts has not been deleted.
   • DIn CloudWatch, verify that the alarm threshold ג€consecutive periodsג€ value is equal to, or greater than 1.

   Show answer

   Answer: C

   Next question

8. Question 138 · 732 in bank

   A company has a web-based application that runs behind an Application Load Balancer (ALB). The application is experiencing a credential stuffing attack that is producing many failed login attempts. The attack is coming from many IP addresses. The login attempts are using a user agent string of a known mobile device emulator. A security engineer needs to implement a solution to mitigate the credential stuffing attack. The solution must still allow legitimate logins to the application. Which solution will meet these requirements?

   • ACreate an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.
   • BModify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack.
   • CCreate an AWS WAF web ACL for the ALB Create a custom rule that blocks requests that contain the user agent string of the device emulator.
   • DCreate an AWS WAF web ACL for the ALB. Create a custom rule that allows requests from legitimate user agent strings.

   Show answer

   Answer: C

   Explanation

   Answer is C A. CloudWatch Alarm with SNS: This would only notify the security team about the attack, not actively block it. B. Deny traffic from attack IPs: This might block legitimate users if they share the same IP range as attackers (e.g., company using a VPN). D. Allow requests from legitimate user agents: Creating an exhaustive list of legitimate user agents is difficult and can be bypassed by attackers using slightly modified strings. Option C targets the specific characteristic of the attack (mobile device emulator user agent) and blocks those requests, allowing legitimate users with different user agents to access the application.

   Source: Adapted from community discussion — aescudero51

   Next question

9. Question 139 · 732 in bank

   A Security Engineer must add additional protection to a legacy web application by adding the following HTTP security headers: -Content Security-Policy -X-Frame-Options -X-XSS-Protection The Engineer does not have access to the source code of the legacy web application. Which of the following approaches would meet this requirement?

   • AConfigure an Amazon Route 53 routing policy to send all web traffic that does not include the required headers to a black hole.
   • BImplement an AWS Lambda@Edge origin response function that inserts the required headers.
   • CMigrate the legacy application to an Amazon S3 static website and front it with an Amazon CloudFront distribution.
   • DConstruct an AWS WAF rule to replace existing HTTP headers with the required security headers by using regular expressions.

   Show answer

   Answer: B

   Next question

10. Question 140 · 732 in bank

    A company is investigating controls to protect sensitive data. The company uses Amazon Simple Notification Service (Amazon SNS) topics to publish messages from application components to custom logging services. The company is concerned that an application component might publish sensitive data that will be accidentally exposed in transaction logs and debug logs. Which solution will protect the sensitive data in these messages from accidental exposure?

    • AUse Amazon Made to scan the SNS topics for sensitive data elements in the SNS messages. Create an AWS Lambda function that masks sensitive data inside the messages when Macie records a new finding.
    • BConfigure an inbound message data protection policy. In the policy, include the De-identify operation to mask the sensitive data inside the messages. Apply the policy to the SNS topics.
    • CConfigure the SNS topics with an AWS Key Management Service (AWS KMS) customer managed key to encrypt the data elements inside the messages. Grant permissions to all message publisher IAM roles to allow access to the key to encrypt data.
    • DCreate an Amazon GuardDuty finding for sensitive data that is transmitted to the SNS topics. Create an AWS Security Hub custom remediation action to block messages that contain sensitive data from being delivered to subscribers of the SNS topics.

    Show answer

    Answer: B

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 131. 732 questions available.