SCS-C02 practice questions 221–230

1. Question 221 · 732 in bank

   A company is using an Amazon CloudFront distribution to deliver content from two origins. One origin is a dynamic application that is hosted on Amazon EC2 instances. The other origin is an Amazon S3 bucket for static assets. A security analysis shows that HTTPS responses from the application do not comply with a security requirement to provide an X-Frame-Options HTTP header to prevent frame-related cross-site scripting attacks. A security engineer must make the full stack compliant by adding the missing HTTP header to the responses. Which solution will meet these requirements?

   • ACreate a Lambda@Edge function. Include code to add the X-Frame-Options header to the response. Configure the function to run in response to the CloudFront origin response event.
   • BCreate a Lambda@Edge function. Include code to add the X-Frame-Options header to the response. Configure the function to run in response to the CloudFront viewer request event.
   • CUpdate the CloudFront distribution by adding X-Frame-Options to custom headers in the origin settings.
   • DCustomize the EC2 hosted application to add the X-Frame-Options header to the responses that are returned to CloudFront.

   Show answer

   Answer: A

   Explanation

   The best solution to meet the requirement of adding the X-Frame-Options HTTP header to the responses is: A. Create a Lambda@Edge function. Include code to add the X-Frame-Options header to the response. Configure the function to run in response to the CloudFront origin response event. This approach ensures that the header is added to all responses, regardless of the origin (EC2 or S3), and it does not require changes to the application code or the CloudFront distribution settings

   Source: Adapted from community discussion — IPLogic

   References

   • AWS documentation

   Next question

2. Question 222 · 732 in bank

   Select 2

   A Security Engineer is building a Java application that is running on Amazon EC2. The application communicates with an Amazon RDS instance and authenticates with a user name and password. Which combination of steps can the Engineer take to protect the credentials and minimize downtime when the credentials are rotated? (Choose two.)

   • AHave a Database Administrator encrypt the credentials and store the ciphertext in Amazon S3. Grant permission to the instance role associated with the EC2 instance to read the object and decrypt the ciphertext.
   • BConfigure a scheduled job that updates the credential in AWS Systems Manager Parameter Store and notifies the Engineer that the application needs to be restarted.
   • CConfigure automatic rotation of credentials in AWS Secrets Manager.
   • DStore the credential in an encrypted string parameter in AWS Systems Manager Parameter Store. Grant permission to the instance role associated with the EC2 instance to access the parameter and the AWS KMS key that is used to encrypt it.
   • EConfigure the Java application to catch a connection failure and make a call to AWS Secrets Manager to retrieve updated credentials when the password is rotated. Grant permission to the instance role associated with the EC2 instance to access Secrets Manager.

   Show answer

   Answer: CE

   Next question

3. Question 223 · 732 in bank

   Select 3

   A company has several production AWS accounts and a central security AWS account. The security account is used for centralized monitoring and has IAM privileges to all resources in every corporate account. All of the company's Amazon S3 buckets are tagged with a value denoting the data classification of their contents. A Security Engineer is deploying a monitoring solution in the security account that will enforce bucket policy compliance. The system must monitor S3 buckets in all production accounts and confirm that any policy change is in accordance with the bucket's data classification. If any change is out of compliance, the Security team must be notified quickly. Which combination of actions would build the required solution? (Choose three.)

   • AConfigure Amazon CloudWatch Events in the production accounts to send all S3 events to the security account event bus.
   • BEnable Amazon GuardDuty in the security account, and join the production accounts as members.
   • CConfigure an Amazon CloudWatch Events rule in the security account to detect S3 bucket creation or modification events.
   • DEnable AWS Trusted Advisor and activate email notifications for an email address assigned to the security contact.
   • EInvoke an AWS Lambda function in the security account to analyze S3 bucket settings in response to S3 events, and send non-compliance notifications to the Security team.
   • FConfigure event notifications on S3 buckets for PUT, POST, and DELETE events.

   Show answer

   Answer: ACE

   Next question

4. Question 224 · 732 in bank

   A company has an AWS Key Management Service (AWS KMS) customer managed key with imported key material. Company policy requires all encryption keys to be rotated every year. What should a security engineer do to meet this requirement for this customer managed key?

   • AEnable automatic key rotation annually for the existing customer managed key.
   • BUse the AWS CLI to create an AWS Lambda function to rotate the existing customer managed key annually.
   • CImport new key material to the existing customer managed key. Manually rotate the key.
   • DCreate a new customer managed key. Import new key material to the new key. Point the key alias to the new key.

   Show answer

   Answer: D

   References

   • AWS documentation

   Next question

5. Question 225 · 732 in bank

   A company plans to migrate a sensitive dataset to Amazon S3. A Security Engineer must ensure that the data is encrypted at rest. The encryption solution must enable the company to generate its own keys without needing to manage key storage or the encryption process. What should the Security Engineer use to accomplish this?

   • AServer-side encryption with Amazon S3-managed keys (SSE-S3)
   • BServer-side encryption with AWS KMS-managed keys (SSE-KMS)
   • CServer-side encryption with customer-provided keys (SSE-C)
   • DClient-side encryption with an AWS KMS-managed CMK

   Show answer

   Answer: B

   Next question

6. Question 226 · 732 in bank

   A healthcare company has multiple AWS accounts in an organization in AWS Organizations. The company uses Amazon S3 buckets to store sensitive information of patients. The company needs to restrict users from deleting any S3 bucket across the organization. What is the MOST scalable solution that meets these requirements?

   • APermissions boundaries in AWS Identity and Access Management (IAM)
   • BS3 bucket policies
   • CTag policies
   • DSCPs

   Show answer

   Answer: D

   Next question

7. Question 227 · 732 in bank

   Select 2

   A Security Engineer is defining the logging solution for a newly developed product. Systems Administrators and Developers need to have appropriate access to event log files in AWS CloudTrail to support and troubleshoot the product. Which combination of controls should be used to protect against tampering with and unauthorized access to log files? (Choose two.)

   • AEnsure that the log file integrity validation mechanism is enabled.
   • BEnsure that all log files are written to at least two separate Amazon S3 buckets in the same account.
   • CEnsure that Systems Administrators and Developers can edit log files, but prevent any other access.
   • DEnsure that Systems Administrators and Developers with job-related need-to-know requirements only are capable of viewing ג€" but not modifying ג€" the log files.
   • EEnsure that all log files are stored on Amazon EC2 instances that allow SSH access from the internal corporate network only.

   Show answer

   Answer: AD

   Next question

8. Question 228 · 732 in bank

   A company needs to detect unauthenticated access to its Amazon Elastic Kubernetes Service (Amazon EKS) clusters. The company needs a solution that requires no additional configuration of the existing EKS deployment. Which solution will meet these requirements with the LEAST operational effort?

   • AInstall an Amazon EKS add-on from a security vendor.
   • BEnable AWS Security Hub. Monitor the Kubernetes findings.
   • CMonitor Amazon CloudWatch Container Insights metrics for Amazon EKS.
   • DEnable Amazon GuardDuty. Use EKS Audit Log Monitoring.

   Show answer

   Answer: D

   References

   • AWS documentation

   Next question

9. Question 229 · 732 in bank

   A company has a few dozen application servers in private subnets behind an Elastic Load Balancer (ELB) in an AWS Auto Scaling group. The application is accessed from the web over HTTPS. The data must always be encrypted in transit. The Security Engineer is worried about potential key exposure due to vulnerabilities in the application software. Which approach will meet these requirements while protecting the external certificate during a breach?

   • AUse a Network Load Balancer (NLB) to pass through traffic on port 443 from the internet to port 443 on the instances.
   • BPurchase an external certificate, and upload it to the AWS Certificate Manager (for use with the ELB) and to the instances. Have the ELB decrypt traffic, and route and re-encrypt with the same certificate.
   • CGenerate an internal self-signed certificate and apply it to the instances. Use AWS Certificate Manager to generate a new external certificate for the ELB. Have the ELB decrypt traffic, and route and re-encrypt with the internal certificate.
   • DUpload a new external certificate to the load balancer. Have the ELB decrypt the traffic and forward it on port 80 to the instances.

   Show answer

   Answer: C

   Next question

10. Question 230 · 732 in bank

    A security engineer is investigating a malware infection that has spread across a set of Amazon EC2 instances. A key indicator of the compromise is outbound traffic on TCP port 2905 to a set of command and control hosts on the internet. The security engineer creates a network ACL rule that denies the identified outbound traffic. The security engineer applies the network ACL rule to the subnet of the EC2 instances. The security engineer must identify any EC2 instances that are trying to communicate on TCP port 2905. Which solution will identify the affected EC2 instances with the LEAST operational effort?

    • ACreate a Network Access Scope in Amazon VPC Network Access Analyzer. Use the Network Access Scope to identify EC2 instances that try to send traffic to TCP port 2905.
    • BEnable VPC flow logs for the VPC where the affected EC2 instances are located. Configure the flow logs to capture rejected traffic. In the flow logs, search for REJECT records that have a destination TCP port of 2905.
    • CEnable Amazon GuardDuty. Create a custom GuardDuty IP list to create a finding when an EC2 instance tries to communicate with one of the command and control hosts. Use Amazon Detective to identify the EC2 instances that initiate the communication.
    • DCreate a firewall in AWS Network Firewall. Attach the firewall to the subnet of the EC2 instances. Create a custom rule to identify and log traffic from the firewall on TCP port 2905. Create an Amazon CloudWatch Logs metric filter to identify firewall logs that reference traffic on TCP port 2905.

    Show answer

    Answer: B

    Explanation

    B, enabling flow logs and filtering for records with REJECT on TCP port 2905, the security engineer can quickly identify which EC2 instances are attempting to communicate with command and control hosts.

    Source: Adapted from community discussion — JCD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 221. 732 questions available.