SCS-C02 practice questions 171–180

1. Question 171 · 732 in bank

   A company has two AWS accounts: Account A and Account B. Account A has an IAM role that IAM users in Account B assume when they need to upload sensitive documents to Amazon S3 buckets in Account A. A new requirement mandates that users can assume the role only if they are authenticated with multi-factor authentication (MFA). A security engineer must recommend a solution that meets this requirement with minimum risk and effort. Which solution should the security engineer recommend?

   • AAdd an aws:MultiFactorAuthPresent condition to the role's permissions policy.
   • BAdd an aws MultiFactorAuthPresent condition to the role’s trust policy.
   • CAdd an aws:MultiFactorAuthPresent condition to the session policy.
   • DAdd an aws:MultiFactorAuthPresent condition to the S3 bucket policies.

   Show answer

   Answer: B

   Explanation

   Option B is the correct answer because adding the aws:MultiFactorAuthPresent condition to the role's trust policy enforces MFA for role assumption, ensuring that only users who have authenticated with MFA can assume the role. This solution meets the requirement effectively and with minimal changes.

   Source: Adapted from community discussion — mikelord

   Next question

2. Question 172 · 732 in bank

   An AWS account includes two S3 buckets: bucket1 and bucket2. The bucket2 does not have a policy defined, but bucket1 has the following bucket policy:

   

   In addition, the same account has an IAM User named `alice`, with the following IAM policy.

   

   Which buckets can user `alice` access?

   • ABucket1 only
   • BBucket2 only
   • CBoth bucket1 and bucket2
   • DNeither bucket1 nor bucket2

   Show answer

   Answer: C

   Next question

3. Question 173 · 732 in bank

   Select 3

   A company uses several AWS CloudFormation stacks to handle the deployment of a suite of applications. The leader of the company's application development team notices that the stack deployments fail with permission errors when some team members try to deploy the stacks. However, other team members can deploy the stacks successfully. The team members access the account by assuming a role that has a specific set of permissions that are necessary for the job responsibilities of the team members. All team members have permissions to perform operations on the stacks. Which combination of steps will ensure consistent deployment of the stacks MOST securely? (Choose three.)

   • ACreate a service role that has a composite principal that contains each service that needs the necessary permissions. Configure the role to allow the sts:AssumeRole action.
   • BCreate a service role that has cloudformation.amazonaws.com as the service principal. Configure the role to allow the sts:AssumeRole action.
   • CFor each required set of permissions, add a separate policy to the role to allow those permissions. Add the ARN of each CloudFormation stack in the resource field of each policy.
   • DFor each required set of permissions, add a separate policy to the role to allow those permissions. Add the ARN of each service that needs the permissions in the resource field of the corresponding policy.
   • EUpdate each stack to use the service role. F Add a policy to each member role to allow the iam:PassRole action. Set the policy's resource field to the ARN of the service role.

   Show answer

   Answer: BDE

   Explanation

   B. Create a service role that has cloudformation.amazonaws.com as the service principal. Configure the role to allow the sts action. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html D. For each required set of permissions, add a separate policy to the role to allow those permissions. Add the ARN of each service that needs the permissions in the resource field of the corresponding policy. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html#using-iam-servicerole-add E. Update each stack to use the service role. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html

   Source: Adapted from community discussion — cumzle_com

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 174 · 732 in bank

   An organization has three applications running on AWS, each accessing the same data on Amazon S3. The data on Amazon S3 is server-side encrypted by using an AWS KMS Customer Master Key (CMK). What is the recommended method to ensure that each application has its own programmatic access control permissions on the KMS CMK?

   • AChange the key policy permissions associated with the KMS CMK for each application when it must access the data in Amazon S3.
   • BHave each application assume an IAM role that provides permissions to use the AWS Certificate Manager CMK.
   • CHave each application use a grant on the KMS CMK to add or remove specific access controls on the KMS CMK.
   • DHave each application use an IAM policy in a user context to have specific access permissions on the KMS CMK.

   Show answer

   Answer: C

   Next question

5. Question 175 · 732 in bank

   A company wants to receive automated email notifications when AWS access keys from developer AWS accounts are detected on code repository sites. Which solution will provide the required email notifications?

   • ACreate an Amazon EventBridge rule to send Amazon Simple Notification Service (Amazon SNS) email notifications for Amazon GuardDuty UnauthorizedAccess:IAMUser/lnstanceCredentialExfiltration.OutsideAWS findings.
   • BChange the AWS account contact information for the Operations type to a separate email address. Periodically poll this email address for notifications.
   • CCreate an Amazon EventBridge rule that reacts to AWS Health events that have a value of Risk for the service category. Configure email notifications by using Amazon Simple Notification Service (Amazon SNS).
   • DImplement new anomaly detection software. Ingest AWS CloudTrail logs. Configure monitoring for ConsoleLogin events in the AWS Management Console. Configure email notifications from the anomaly detection software.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

6. Question 176 · 732 in bank

   The Security Engineer is given the following requirements for an application that is running on Amazon EC2 and managed by using AWS CloudFormation templates with EC2 Auto Scaling groups: -Have the EC2 instances bootstrapped to connect to a backend database. -Ensure that the database credentials are handled securely. -Ensure that retrievals of database credentials are logged. Which of the following is the MOST efficient way to meet these requirements?

   • APass databases credentials to EC2 by using CloudFormation stack parameters with the property set to true. Ensure that the instance is configured to log to Amazon CloudWatch Logs.
   • BStore database passwords in AWS Systems Manager Parameter Store by using SecureString parameters. Set the IAM role for the EC2 instance profile to allow access to the parameters.
   • CCreate an AWS Lambda that ingests the database password and persists it to Amazon S3 with server-side encryption. Have the EC2 instances retrieve the S3 object on startup, and log all script invocations to syslog.
   • DWrite a script that is passed in as UserData so that it is executed upon launch of the EC2 instance. Ensure that the instance is configured to log to Amazon CloudWatch Logs.

   Show answer

   Answer: B

   Next question

7. Question 177 · 732 in bank

   A company deployed an Amazon EC2 instance to a VPC on AWS. A recent alert indicates that the EC2 instance is receiving a suspicious number of requests over an open TCP port from an external source. The TCP port remains open for long periods of time. The company's security team needs to stop all activity to this port from the external source to ensure that the EC2 instance is not being compromised. The application must remain available to other users. Which solution will meet these requirements?

   • AUpdate the network ACL that is attached to the subnet that is associated with the EC2 instance. Add a Deny statement for the port and the source IP addresses.
   • BUpdate the elastic network interface security group that is attached to the EC2 instance to remove the port from the inbound rule list.
   • CUpdate the elastic network interface security group that is attached to the EC2 instance by adding a Deny entry in the inbound list for the port and the source IP addresses.
   • DCreate a new network ACL for the subnet. Deny all traffic from the EC2 instance to prevent data from being removed.

   Show answer

   Answer: A

   Next question

8. Question 178 · 732 in bank

   A company has two AWS accounts, each containing one VPC. The first VPC has a VPN connection with its corporate network. The second VPC, without a VPN, hosts an Amazon Aurora database cluster in private subnets. Developers manage the Aurora database from a bastion host in a public subnet as shown in the image.

   

   A security review has flagged this architecture as vulnerable, and a Security Engineer has been asked to make this design more secure. The company has a short deadline and a second VPN connection to the Aurora account is not possible. How can the Security Engineer securely set up the bastion host?

   • AMove the bastion host to the VPC with VPN connectivity. Create a VPC peering relationship between the bastion host VPC and Aurora VPC.
   • BCreate an SSH port forwarding tunnel on the Developer's workstation to the bastion host to ensure that only authorized SSH clients can access the bastion host.
   • CMove the bastion host to the VPC with VPN connectivity. Create a cross-account trust relationship between the bastion VPC and Aurora VPC, and update the Aurora security group for the relationship.
   • DCreate an AWS Direct Connect connection between the corporate network and the Aurora account, and adjust the Aurora security group for this connection.

   Show answer

   Answer: A

   Next question

9. Question 179 · 732 in bank

   Select 2

   A company has secured the AWS account root user for its AWS account by following AWS best practices. The company also has enabled AWS CloudTrail, which is sending its logs to Amazon S3. A security engineer wants to receive notification in near-real time if a user uses the AWS account root user credentials to sign in to the AWS Management Console Which solutions will provide this notification? (Choose two.)

   • AUse AWS Trusted Advisor and its security evaluations for the root account. Configure an Amazon EventBridge event rule that is invoked by the Trusted Advisor API. Configure the rule to target an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe any required endpoints to the SNS topic so that these endpoints can receive notification.
   • BUse AWS IAM Access Analyzer. Create an Amazon Cloud Watch Logs metric filter to evaluate log entries from Access Analyzer that detect a successful root account login. Create an Amazon CloudWatch alarm that monitors whether a root login has occurred. Configure the CloudWatch alarm to notify an Amazon Simple Notification Service (Amazon SNS) topic when the alarm enters the ALARM state. Subscribe any required endpoints to this SNS topic so that these endpoints can receive notification.
   • CConfigure AWS CloudTrail to send its logs to Amazon CloudWatch Logs. Configure a metric filter on the CloudWatch Logs log group used by CloudTrail to evaluate log entries for successful root account logins. Create an Amazon CloudWatch alarm that monitors whether a root login has occurred. Configure the CloudWatch alarm to notify an Amazon Simple Notification Service (Amazon SNS) topic when the alarm enters the ALARM state. Subscribe any required endpoints to this SNS topic so that these endpoints can receive notification.
   • DConfigure AWS CloudTrail to send log notifications to an Amazon Simple Notification Service (Amazon SNS) topic. Create an AWS Lambda function that parses the CloudTrail notification for root login activity and notifies a separate SNS topic that contains the endpoints that should receive notification. Subscribe the Lambda function to the SNS topic that is receiving log notifications from CloudTrail.
   • EConfigure an Amazon EventBridge event rule that runs when Amazon CloudWatch API calls are recorded for a successful root login. Configure the rule to target an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe any required endpoints to the SNS topic so that these endpoints can receive notification.

   Show answer

   Answer: CE

   Explanation

   The correct answers are C and E - Option C is correct because using CloudTrail with CloudWatch Logs and setting up a metric filter and alarm will detect and alert for root login events effectively. - E is also correct as EventBridge can capture specific root login events through CloudTrail and trigger an SNS notification, providing near-real-time alerts. Why Other Options Are Incorrect: - A is incorrect because AWS Trusted Advisor does not provide real-time alerts specifically for root login events; it is more of a best practice and configuration monitoring tool. - B is incorrect because IAM Access Analyzer does not monitor root login events. It's primarily for access policy analysis. - D is incorrect because CloudTrail alone does not provide log notifications to SNS without additional steps like CloudWatch Logs and Lambda integration.

   Source: Adapted from community discussion — gjurro

   Next question

10. Question 180 · 732 in bank

    An organization operates a web application that serves users globally. The application runs on Amazon EC2 instances behind an Application Load Balancer. There is an Amazon CloudFront distribution in front of the load balancer, and the organization uses AWS WAF. The application is currently experiencing a volumetric attack whereby the attacker is exploiting a bug in a popular mobile game. The application is being flooded with HTTP requests from all over the world with the User-Agent set to the following string: Mozilla/5.0 (compatible; ExampleCorp; ExampleGame/1.22; Mobile/1.0) What mitigation can be applied to block attacks resulting from this bug while continuing to service legitimate requests?

    • ACreate a rule in AWS WAF rules with conditions that block requests based on the presence of ExampleGame/1.22 in the User-Agent header
    • BCreate a geographic restriction on the CloudFront distribution to prevent access to the application from most geographic regions
    • CCreate a rate-based rule in AWS WAF to limit the total number of requests that the web application services.
    • DCreate an IP-based blacklist in AWS WAF to block the IP addresses that are originating from requests that contain ExampleGame/1.22 in the User-Agent header.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 171. 732 questions available.