SCS-C02 practice questions 191–200

1. Question 191 · 732 in bank

   A company is storing data in Amazon S3 Glacier. A security engineer implemented a new vault lock policy for 10 TB of data and called the initiate-vault-lock operation 12 hours ago. The audit team identified a typo in the policy that is allowing unintended access to the vault. What is the MOST cost-effective way to correct this error?

   • ACall the abort-vault-lock operation. Update the policy. Call the initiate-vault-lock operation again.
   • BCopy the vault data to a new S3 bucket. Delete the vault Create a new vault with the data.
   • CUpdate the policy to keep the vault lock in place.
   • DUpdate the policy. Call the initiate-vault-lock operation again to apply the new policy.

   Show answer

   Answer: A

   Next question

2. Question 192 · 732 in bank

   Select 3

   An Amazon EC2 instance is part of an EC2 Auto Scaling group that is behind an Application Load Balancer (ALB). It is suspected that the EC2 instance has been compromised. Which steps should be taken to investigate the suspected compromise? (Choose three.)

   • ADetach the elastic network interface from the EC2 instance.
   • BInitiate an Amazon Elastic Block Store volume snapshot of all volumes on the EC2 instance.
   • CDisable any Amazon Route 53 health checks associated with the EC2 instance.
   • DDe-register the EC2 instance from the ALB and detach it from the Auto Scaling group.
   • EAttach a security group that has restrictive ingress and egress rules to the EC2 instance.
   • FAdd a rule to an AWS WAF to block access to the EC2 instance.

   Show answer

   Answer: BDE

   Next question

3. Question 193 · 732 in bank

   A company uses HTTP Live Streaming (HLS) to stream live video content to paying subscribers by using Amazon CloudFront. HLS splits the video content into chunks so that the user can request the right chunk based on different conditions. Because the video events last for several hours, the total video is made up of thousands of chunks. The origin URL is not disclosed, and every user is forced to access the CloudFront URL. The company has a web application that authenticates the paying users against an internal repository and a CloudFront key pair that is already issued. What is the simplest and MOST effective way to protect the content?

   • ADevelop the application to use the CloudFront key pair to create signed URLs that users will use to access the content.
   • BDevelop the application to use the CloudFront key pair to set the signed cookies that users will use to access the content.
   • CDevelop the application to issue a security token that Lambda@Edge will receive to authenticate and authorize access to the content.
   • DKeep the CloudFront URL encrypted inside the application, and use AWS KMS to resolve the URL on-the-fly after the user is authenticated.

   Show answer

   Answer: B

   References

   • AWS documentation

   Next question

4. Question 194 · 732 in bank

   Select 3

   A company has five AWS accounts and wants to use AWS CloudTrail to log API calls. The log files must be stored in an Amazon S3 bucket that resides in a new account specifically built for centralized services with a unique top-level prefix for each trail. The configuration must also enable detection of any modification to the logs. Which of the following steps will implement these requirements? (Choose three.)

   • ACreate a new S3 bucket in a separate AWS account for centralized storage of CloudTrail logs, and enable ג€Log File Validationג€ on all trails.
   • BUse an existing S3 bucket in one of the accounts, apply a bucket policy to the new centralized S3 bucket that permits the CloudTrail service to use the "s3: PutObject" action and the "s3 GetBucketACL" action, and specify the appropriate resource ARNs for the CloudTrail trails.
   • CApply a bucket policy to the new centralized S3 bucket that permits the CloudTrail service to use the "s3 PutObject" action and the "s3 GelBucketACL" action, and specify the appropriate resource ARNs for the CloudTrail trails.
   • DUse unique log file prefixes for trails in each AWS account.
   • EConfigure CloudTrail in the centralized account to log all accounts to the new centralized S3 bucket.
   • FEnable encryption of the log files by using AWS Key Management Service

   Show answer

   Answer: ACD

   Next question

5. Question 195 · 732 in bank

   A company used a lift-and-shift approach to migrate from its on-premises data centers to the AWS Cloud. The company migrated on-premises VMs to Amazon EC2 instances. Now the company wants to replace some of components that are running on the EC2 instances with managed AWS services that provide similar functionality. Initially, the company will transition from load balancer software that runs on EC2 instances to AWS Elastic Load Balancers. A security engineer must ensure that after this transition, all the load balancer logs are centralized and searchable for auditing. The security engineer must also ensure that metrics are generated to show which ciphers are in use. Which solution will meet these requirements?

   • ACreate an Amazon CloudWatch Logs log group. Configure the load balancers to send logs to the log group. Use the CloudWatch Logs console to search the logs. Create CloudWatch Logs filters on the logs for the required metrics.
   • BCreate an Amazon S3 bucket. Configure the load balancers to send logs to the S3 bucket. Use Amazon Athena to search the logs that are in the S3 bucket. Create Amazon CloudWatch filters on the S3 log files for the required metrics.
   • CCreate an Amazon S3 bucket. Configure the load balancers to send logs to the S3 bucket. Use Amazon Athena to search the logs that are in the S3 bucket. Create Athena queries for the required metrics. Publish the metrics to Amazon CloudWatch.
   • DCreate an Amazon CloudWatch Logs log group. Configure the load balancers to send logs to the log group. Use the AWS Management Console to search the logs. Create Amazon Athena queries for the required metrics. Publish the metrics to Amazon CloudWatch.

   Show answer

   Answer: C

   Explanation

   You can't send ELB access logs into CloudWatch Logs, but to S3 only: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/enable-access-logging.html Regarding the alarm, natively there is no way to use query result as a metric.We could use a Lambda Function for this. C remains the most valid option.

   Source: Adapted from community discussion — Ghe

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 196 · 732 in bank

   An application uses Amazon Cognito to manage end users' permissions when directly accessing AWS resources, including Amazon DynamoDB. A new feature request reads as follows: Provide a mechanism to mark customers as suspended pending investigation or suspended permanently. Customers should still be able to log in when suspended, but should not be able to make changes. The priorities are to reduce complexity and avoid potential for future security issues. Which approach will meet these requirements and priorities?

   • ACreate a new database field ג€suspended_statusג€ and modify the application logic to validate that field when processing requests.
   • BAdd suspended customers to second Cognito user pool and update the application login flow to check both user pools.
   • CUse Amazon Cognito Sync to push out a ג€suspension_statusג€ parameter and split the IAM policy into normal users and suspended users.
   • DMove suspended customers to a second Cognito group and define an appropriate IAM access policy for the group.

   Show answer

   Answer: D

   Next question

7. Question 197 · 732 in bank

   A company operates a web application that runs on Amazon EC2 instances. The application listens on port 80 and port 443. The company uses an Application Load Balancer (ALB) with AWS WAF to terminate SSL and to forward traffic to the application instances only on port 80. The ALB is in public subnets that are associated with a network ACL that is named NACL1. The application instances are in dedicated private subnets that are associated with a network ACL that is named NACL2. An Amazon RDS for PostgreSQL DB instance that uses port 5432 is in a dedicated private subnet that is associated with a network ACL that is named NACL3. All the network ACLs currently allow all inbound and outbound traffic. Which set of network ACL changes will increase the security of the application while ensuring functionality?

   • AMake the following changes to NACL3: • Add a rule that allows inbound traffic on port 5432 from NACL2. • Add a rule that allows outbound traffic on ports 1024-65536 to NACL2. • Remove the default rules that allow all inbound and outbound traffic.
   • BMake the following changes to NACL3: • Add a rule that allows inbound traffic on port 5432 from the Cl DR blocks of the application instance subnets. • Add a rule that allows outbound traffic on ports 1024-65536 to the application instance subnets. • Remove the default rules that allow all inbound and outbound traffic.
   • CMake the following changes to NACL2: • Add a rule that allows outbound traffic on port 5432 to the CIDR blocks of the RDS subnets. • Remove the default rules that allow all inbound and outbound traffic.
   • DMake the following changes to NACL2: • Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the RDS subnets. • Add a rule that allows outbound traffic on port 5432 to the RDS subnets.

   Show answer

   Answer: B

   Explanation

   I think B is correct. Inbound 5432 is allowed and outbound for ephemeral ports. Answer A is wrong as you can't use other NACL as a source.

   Source: Adapted from community discussion — maciekmacku

   Next question

8. Question 198 · 732 in bank

   A company stores data on an Amazon EBS volume attached to an Amazon EC2 instance. The data is asynchronously replicated to an Amazon S3 bucket. Both the EBS volume and the S3 bucket are encrypted with the same AWS KMS Customer Master Key (CMK). A former employee scheduled a deletion of that CMK before leaving the company. The company's Developer Operations department learns about this only after the CMK has been deleted. Which steps must be taken to address this situation?

   • ACopy the data directly from the EBS encrypted volume before the volume is detached from the EC2 instance.
   • BRecover the data from the EBS encrypted volume using an earlier version of the KMS backing key.
   • CMake a request to AWS Support to recover the S3 encrypted data.
   • DMake a request to AWS Support to restore the deleted CMK, and use it to recover the data.

   Show answer

   Answer: A

   Next question

9. Question 199 · 732 in bank

   A company has public certificates that are managed by AWS Certificate Manager (ACM). The certificates are either imported certificates or managed certificates from ACM with mixed validation methods. A security engineer needs to design a monitoring solution to provide alerts by email when a certificate is approaching its expiration date. What is the MOST operationally efficient way to meet this requirement?

   • ACreate an AWS Lambda function to list all certificates and to go through each certificate to describe the certificate by using the AWS SDK. Filter on the NotAfter attribute and send an email notification. Use an Amazon EventBridge rate expression to schedule the Lambda function to run daily.
   • BCreate an Amazon CloudWatch alarm. Add all the certificate ARNs in the AWS/CertificateManager namespace to the DaysToExpiry metric. Configure the alarm to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic when the value for the DaysToExpiry metric is less than or equal to 31.
   • CSet up AWS Security Hub. Turn on the AWS Foundational Security Best Practices standard with integrated ACM to send findings. Configure and use a custom action by creating a rule to match the pattern from the ACM findings on the NotBefore attribute as the event source. Create an Amazon Simple Notification Service (Amazon SNS) topic as the target.
   • DCreate an Amazon EventBridge rule by using a predefined pattern for ACM Choose the metric in the ACM Certificate Approaching Expiration event as the event pattern. Create an Amazon Simple Notification Service (Amazon SNS) topic as the target.

   Show answer

   Answer: D

   Next question

10. Question 200 · 732 in bank

    A company has Windows Amazon EC2 instances in a VPC that are joined to on-premises Active Directory servers for domain services. The security team has enabled Amazon GuardDuty on the AWS account to alert on issues with the instances. During a weekly audit of network traffic, the Security Engineer notices that one of the EC2 instances is attempting to communicate with a known command-and- control server but failing. This alert does not show up in GuardDuty. Why did GuardDuty fail to alert to this behavior?

    • AGuardDuty did not have the appropriate alerts activated.
    • BGuardDuty does not see these DNS requests.
    • CGuardDuty only monitors active network traffic flow for command-and-control activity.
    • DGuardDuty does not report on command-and-control activity.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 191. 732 questions available.