SCS-C02 practice questions 161–170

1. Question 161 · 732 in bank

   Select 2

   A company has multiple VPCs in their account that are peered, as shown in the diagram. A Security Engineer wants to perform penetration tests of the Amazon EC2 instances in all three VPCs. How can this be accomplished? (Choose two.)

   

   • ADeploy a pre-authorized scanning engine from the AWS Marketplace into VPC B, and use it to scan instances in all three VPCs. Do not complete the penetration test request form.
   • BDeploy a pre-authorized scanning engine from the Marketplace into each VPC, and scan instances in each VPC from the scanning engine in that VPC. Do not complete the penetration test request form.
   • CCreate a VPN connection from the data center to VPC A. Use an on-premises scanning engine to scan the instances in all three VPCs. Complete the penetration test request form for all three VPCs.
   • DCreate a VPN connection from the data center to each of the three VPCs. Use an on-premises scanning engine to scan the instances in each VPC. Do not complete the penetration test request form.
   • ECreate a VPN connection from the data center to each of the three VPCs. Use an on-premises scanning engine to scan the instances in each VPC. Complete the penetration test request form for all three VPCs.

   Show answer

   Answer: BD

   Next question

2. Question 162 · 732 in bank

   A security engineer needs to run an AWS CloudFormation script. The CloudFormation script builds AWS infrastructure to support a stack that includes web servers and a MySQL database. The stack has been deployed in pre-production environments and is ready for production. The production script must comply with the principle of least privilege. Additionally, separation of duties must exist between the security engineer’s IAM account and CloudFormation. Which solution will meet these requirements?

   • AUse IAM Access Analyzer policy generation to generate a policy that allows the CloudFormation script to run and manage the stack. Attach the policy to a new IAM role. Modify the security engineer's IAM permissions to be able to pass the new role to CloudFormation.
   • BCreate an IAM policy that allows ec2:* and rds:* permissions. Attach the policy to a new IAM role. Modify the security engineer's IAM permissions to be able to assume the new role.
   • CUse IAM Access Analyzer policy generation to generate a policy that allows the CloudFormation script to run and manage the stack. Modify the security engineer's IAM permissions to be able to run the CloudFormation script.
   • DCreate an IAM policy that allows ec2:* and rds:* permissions. Attach the policy to a new IAM role. Use the IAM policy simulator to confirm that the policy allows the AWS API calls that are necessary to build the stack. Modify the security engineer's IAM permissions to be able to pass the new role to CloudFormation.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

3. Question 163 · 732 in bank

   Select 2

   The Security Engineer is managing a traditional three-tier web application that is running on Amazon EC2 instances. The application has become the target of increasing numbers of malicious attacks from the Internet. What steps should the Security Engineer take to check for known vulnerabilities and limit the attack surface? (Choose two.)

   • AUse AWS Certificate Manager to encrypt all traffic between the client and application servers.
   • BReview the application security groups to ensure that only the necessary ports are open.
   • CUse Elastic Load Balancing to offload Secure Sockets Layer encryption.
   • DUse Amazon Inspector to periodically scan the backend instances.
   • EUse AWS Key Management Services to encrypt all the traffic between the client and application servers.

   Show answer

   Answer: BD

   Next question

4. Question 164 · 732 in bank

   Select 2

   A company that uses AWS Organizations is migrating workloads to AWS. The company's application team determines that the workloads will use Amazon EC2 instances, Amazon S3 buckets, Amazon DynamoDB tables, and Application Load Balancers. For each resource type, the company mandates that deployments must comply with the following requirements: • All EC2 instances must be launched from approved AWS accounts. • All DynamoDB tables must be provisioned with a standardized naming convention. • All infrastructure that is provisioned in any accounts in the organization must be deployed by AWS CloudFormation templates. Which combination of steps should the application team take to meet these requirements? (Choose two.)

   • ACreate CloudFormation templates in an administrator AWS account. Share the stack sets with an application AWS account. Restrict the template to be used specifically by the application AWS account.
   • BCreate CloudFormation templates in an application AWS account. Share the output with an administrator AWS account ta review compliant resources. Restrict output to only the administrator AWS account.
   • CUse permissions boundaries to prevent the application AWS account from provisioning specific resources unless conditions for the internal compliance requirements are met.
   • DUse SCPs to prevent the application AWS account from provisioning specific resources unless conditions for the internal compliance requirements are met.
   • EActivate AWS Config managed rules for each service in the application AWS account.

   Show answer

   Answer: AD

   Next question

5. Question 165 · 732 in bank

   For compliance reasons, an organization limits the use of resources to three specific AWS regions. It wants to be alerted when any resources are launched in unapproved regions. Which of the following approaches will provide alerts on any resources launched in an unapproved region?

   • ADevelop an alerting mechanism based on processing AWS CloudTrail logs.
   • BMonitor Amazon S3 Event Notifications for objects stored in buckets in unapproved regions.
   • CAnalyze Amazon CloudWatch Logs for activities in unapproved regions.
   • DUse AWS Trusted Advisor to alert on all resources being created.

   Show answer

   Answer: A

   Next question

6. Question 166 · 732 in bank

   Select 2

   A company has a batch-processing system that uses Amazon S3, Amazon EC2, and AWS Key Management Service (AWS KMS). The system uses two AWS accounts: Account A and Account B. Account A hosts an S3 bucket that stores the objects that will be processed. The S3 bucket also stores the results of the processing. All the S3 bucket objects are encrypted by a KMS key that is managed in Account A. Account B hosts a VPC that has a fleet of EC2 instances that access the S3 bucket in Account A by using statements in the bucket policy. The VPC was created with DNS hostnames enabled and DNS resolution enabled. A security engineer needs to update the design of the system without changing any of the system's code. No AWS API calls from the batch-processing EC2 instances can travel over the internet. Which combination of steps will meet these requirements? (Choose two.)

   • AIn the Account B VPC, create a gateway VPC endpoint for Amazon S3. For the gateway VPC endpoint, create a resource policy that allows the s3:GetObject, s3:ListBucket, s3:PutObject, and s3:PutObjectAcl actions for the S3 bucket.
   • BIn the Account B VPC, create an interface VPC endpoint for Amazon S3. For the interface VPC endpoint, create a resource policy that allows the s3:GetObject, s3:ListBucket, s3:PutObject, and s3:PutObjectAcl actions for the S3 bucket.
   • CIn the Account B VPC, create an interface VPC endpoint for AWS KMS. For the interface VPC endpoint, create a resource policy that allows the kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey actions for the KMS key. Ensure that private DNS is turned on for the endpoint.
   • DIn the Account B VPC, create an interface VPC endpoint for AWS KMS. For the interface VPC endpoint, create a resource policy that allows the kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey actions for the KMS key. Ensure that private DNS is turned off for the endpoint.
   • EIn the Account B VPC, verify that the S3 bucket policy allows the s3:PutObjectAcl action for cross-account use. In the Account B VPC, create a gateway VPC endpoint for Amazon S3. For the gateway VPC endpoint, create a resource policy that allows the s3:GetObject, s3:ListBucket, and s3:PutObject actions for the S3 bucket.

   Show answer

   Answer: AC

   Explanation

   I will going to AC, when I look at the question , I saw "fleet of EC2" this means Account B have many EC2. Go to link. you will see many topology, and you will understand what I mean. https://aws.amazon.com/tr/blogs/architecture/choosing-your-vpc-endpoint-strategy-for-amazon-s3/

   Source: Adapted from community discussion — komik_101

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 167 · 732 in bank

   A company runs an application on AWS that needs to be accessed only by employees. Most employees work from the office, but others work remotely or travel. How can the Security Engineer protect this workload so that only employees can access it?

   • AAdd each employee's home IP address to the security group for the application so that only those users can access the workload.
   • BCreate a virtual gateway for VPN connectivity for each employee, and restrict access to the workload from within the VPC.
   • CUse a VPN appliance from the AWS Marketplace for users to connect to, and restrict workload access to traffic from that appliance.
   • DRoute all traffic to the workload through AWS WAF. Add each employee's home IP address into an AWS WAF rule, and block all other traffic.

   Show answer

   Answer: C

   Next question

8. Question 168 · 732 in bank

   A security engineer is designing an IAM policy for a script that will use the AWS CLI. The script currently assumes an IAM role that is attached to three AWS managed IAM policies: AmazonEC2FullAccess, AmazonDynamoDBFullAccess, and AmazonVPCFullAccess. The security engineer needs to construct a least privilege IAM policy that will replace the AWS managed IAM policies that are attached to this role. Which solution will meet these requirements in the MOST operationally efficient way?

   • AIn AWS CloudTrail, create a trail for management events. Run the script with the existing AWS managed IAM policies. Use IAM Access Analyzer to generate a new IAM policy that is based on access activity in the trail. Replace the existing AWS managed IAM policies with the generated IAM policy for the role.
   • BRemove the existing AWS managed IAM policies from the role. Attach the IAM Access Analyzer Role Policy Generator to the role. Run the script. Return to IAM Access Analyzer and generate a least privilege IAM policy. Attach the new IAM policy to the role.
   • CCreate an account analyzer in IAM Access Analyzer. Create an archive rule that has a filter that checks whether the PrincipalArn value matches the ARN of the role. Run the script. Remove the existing AWS managed IAM policies from the role.
   • DIn AWS CloudTrail, create a trail for management events. Remove the existing AWS managed IAM policies from the role. Run the script. Find the authorization failure in the trail event that is associated with the script. Create a new IAM policy that includes the action and resource that caused the authorization failure. Repeat the process until the script succeeds. Attach the new IAM policy to the role.

   Show answer

   Answer: A

   Explanation

   Option A provides the most operationally efficient solution by leveraging AWS CloudTrail to log access activity and IAM Access Analyzer to automatically generate a least privilege policy based on that activity. This approach minimizes manual intervention and ensures that the resulting IAM policy grants only the permissions necessary for the script to function, adhering to the principle of least privilege.

   Source: Adapted from community discussion — mikelord

   References

   • AWS documentation

   Next question

9. Question 169 · 732 in bank

   A security engineer is designing a cloud architecture to support an application. The application runs on Amazon EC2 instances and processes sensitive information, including credit card numbers. The application will send the credit card numbers to a component that is running in an isolated environment. The component will encrypt, store, and decrypt the numbers. The component then will issue tokens to replace the numbers in other parts of the application. The component of the application that manages the tokenization process will be deployed on a separate set of EC2 instances. Other components of the application must not be able to store or access the credit card numbers. Which solution will meet these requirements?

   • AUse EC2 Dedicated Instances for the tokenization component of the application.
   • BPlace the EC2 instances that manage the tokenization process into a partition placement group.
   • CCreate a separate VPDeploy new EC2 instances into the separate VPC to support the data tokenization.
   • DDeploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances.

   Show answer

   Answer: D

   References

   • AWS documentation

   Next question

10. Question 170 · 732 in bank

    A Security Architect is evaluating managed solutions for storage of encryption keys. The requirements are: -Storage is accessible by using only VPCs. -Service has tamper-evident controls. -Access logging is enabled. -Storage has high availability. Which of the following services meets these requirements?

    • AAmazon S3 with default encryption
    • BAWS CloudHSM
    • CAmazon DynamoDB with server-side encryption
    • DAWS Systems Manager Parameter Store

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 161. 732 questions available.