SCS-C02 practice questions 231–240

1. Question 231 · 732 in bank

   Select 2

   Which of the following are valid event sources that are associated with web access control lists that trigger AWS WAF rules? (Choose two.)

   • AAmazon S3 static web hosting
   • BAmazon CloudFront distribution
   • CApplication Load Balancer
   • DAmazon Route 53
   • EVPC Flow Logs

   Show answer

   Answer: BC

   Next question

2. Question 232 · 732 in bank

   A security engineer uses Amazon Macie to scan a company’s Amazon S3 buckets for sensitive data. The company has many S3 buckets and many objects stored in the S3 buckets. The security engineer must identify S3 buckets that contain sensitive data and must perform additional scanning on those S3 buckets. Which solution will meet these requirements with the LEAST administrative overhead?

   • AConfigure S3 Cross-Region Replication (CRR) on the S3 buckets to replicate the objects to a second AWS Region. Configure Macie in the second Region to scan the replicated objects daily.
   • BCreate an AWS Lambda function as an S3 event destination for the S3 buckets. Configure the Lambda function to start a Macie scan of an object when the object is uploaded to an S3 bucket.
   • CConfigure Macie automated discovery to continuously sample data from the S3 buckets. Perform full scans of the S3 buckets where Macie discovers sensitive data.
   • DConfigure Macie scans to run on the S3 buckets. Aggregate the results of the scans in an Amazon DynamoDB table. Use the DynamoDB table for queries.

   Show answer

   Answer: C

   Explanation

   The best solution to meet the requirements with the least administrative overhead is: C. Configure Macie automated discovery to continuously sample data from the S3 buckets. Perform full scans of the S3 buckets where Macie discovers sensitive data. This approach leverages Macie’s automated discovery feature, which continuously samples data to identify sensitive information. It minimizes manual intervention and administrative tasks, allowing you to focus full scans only on buckets where sensitive data is detected.

   Source: Adapted from community discussion — IPLogic

   Next question

3. Question 233 · 732 in bank

   A company uses identity federation to authenticate users into an identity account (987654321987) where the users assume an IAM role named IdentityRole. The users then assume an IAM role named JobFunctionRole in the target AWS account (123456789123) to perform their job functions. A user is unable to assume the IAM role in the target account. The policy attached to the role in the identity account is:

   

   What should be done to enable the user to assume the appropriate role in the target account?

   • AUpdate the IAM policy attached to the role in the identity account to be: //IMG//
   • BUpdate the trust policy on the role in the target account to be: //IMG//
   • CUpdate the trust policy on the role in the identity account to be: //IMG//
   • DUpdate the IAM policy attached to the role in the target account to be: //IMG//

   Show answer

   Answer: B

   Next question

4. Question 234 · 732 in bank

   Select 2

   A company has a legacy application that runs on a single Amazon EC2 instance. A security audit shows that the application has been using an IAM access key within its code to access an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET1 in the same AWS account. This access key pair has the s3:GetObject permission to all objects in only this S3 bucket. The company takes the application offline because the application is not compliant with the company’s security policies for accessing other AWS resources from Amazon EC2. A security engineer validates that AWS CloudTrail is turned on in all AWS Regions. CloudTrail is sending logs to an S3 bucket that is named DOC-EXAMPLE-BUCKET2. This S3 bucket is in the same AWS account as DOC-EXAMPLE-BUCKET1. However, CloudTrail has not been configured to send logs to Amazon CloudWatch Logs. The company wants to know if any objects in DOC-EXAMPLE-BUCKET1 were accessed with the IAM access key in the past 60 days. If any objects were accessed, the company wants to know if any of the objects that are text files (.txt extension) contained personally identifiable information (PII). Which combination of steps should the security engineer take to gather this information? (Choose two.)

   • AUse Amazon CloudWatch Logs Insights to identify any objects in DOC-EXAMPLE-BUCKET1 that contain PII and that were available to the access key.
   • BUse Amazon OpenSearch Service to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for API calls that used the access key to access an object that contained PII.
   • CUse Amazon Athena to query the CloudTrail logs in DOC-EXAMPLE-BUCKET2 for any API calls that used the access key to access an object that contained PII.
   • DUse AWS Identity and Access Management Access Analyzer to identify any API calls that used the access key to access objects that contained PII in DOC-EXAMPLE-BUCKET1.
   • EConfigure Amazon Macie to identify any objects in DOC-EXAMPLE-BUCKET1 that contain PII and that were available to the access key.

   Show answer

   Answer: CE

   Explanation

   User Macie to find the PII (E). Use Athena to search the CloudTrail bucket (bucket2) to find out who accessed the PII files (C).

   Source: Adapted from community discussion — hb0011

   References

   • AWS documentation

   Next question

5. Question 235 · 732 in bank

   A Security Engineer is working with the development team to design a supply chain application that stores sensitive inventory data in an Amazon S3 bucket. The application will use an AWS KMS customer master key (CMK) to encrypt the data on Amazon S3. The inventory data on Amazon S3 will be shared of vendors. All vendors will use AWS principals from their own AWS accounts to access the data on Amazon S3. The vendor list may change weekly, and the solution must support cross-account access. What is the MOST efficient way to manage access control for the KMS CMK7?

   • AUse KMS grants to manage key access. Programmatically create and revoke grants to manage vendor access.
   • BUse an IAM role to manage key access. Programmatically update the IAM role policies to manage vendor access.
   • CUse KMS key policies to manage key access. Programmatically update the KMS key policies to manage vendor access.
   • DUse delegated access across AWS accounts by using IAM roles to manage key access. Programmatically update the IAM trust policy to manage cross- account vendor access.

   Show answer

   Answer: A

   Next question

6. Question 236 · 732 in bank

   A security engineer for a large company is managing a data processing application used by 1,500 subsidiary companies. The parent and subsidiary companies all use AWS. The application uses TCP port 443 and runs on Amazon C2 behind a Network Load Balancer (NLB). For compliance reasons, the application should only be accessible to the subsidiaries and should not be available on the public internet. To meet the compliance requirements for restricted access, the engineer has received the public and private CIDR block ranges for each subsidiary. What solution should the engineer use to implement the appropriate access restrictions for the application?

   • ACreate a NACL to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the NACL to both the NLB and EC2 instances.
   • BCreate an AWS security group to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the security group to the NLCreate a second security group for EC2 instances with access on TCP port 443 from the NLB security group.
   • CCreate an AWS PrivateLink endpoint service in the parent company account attached to the NLB. Create an AWS security group for the instances to allow access on TCP port 443 from the AWS PrivateLink endpoint. Use AWS PrivateLink interface endpoints in the 1,500 subsidiary AWS accounts to connect to the data processing application.
   • DCreate an AWS security group to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the security group with EC2 instances.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

7. Question 237 · 732 in bank

   A Security Engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled. While testing the solution, the Security Engineer discovers that the digest files are readable, but the log files are not. What is the MOST likely cause?

   • AThe log files fail integrity validation and automatically are marked as unavailable.
   • BThe KMS key policy does not grant the Security Engineer's IAM user or role permissions to decrypt with it.
   • CThe bucket is set up to use server-side encryption with Amazon S3-managed keys (SSE-S3) as the default and does not allow SSE-KMS-encrypted files.
   • DAn IAM policy applicable to the Security Engineer's IAM user or role denies access to the "CloudTrail/" prefix in the Amazon S3 bucket.

   Show answer

   Answer: B

   Next question

8. Question 238 · 732 in bank

   A company runs workloads on Amazon EC2 instances. The company needs to continually scan the EC2 instances for software vulnerabilities and unintended network exposure. Which solution will meet these requirements?

   • AUse Amazon Inspector. Set the scan mode to hybrid scanning.
   • BUse Amazon GuardDuty. Enable the Malware Protection feature.
   • CUse Amazon Inspector. Enable the Malware Protection feature.
   • DUse Amazon GuardDuty. Enable the Runtime Monitoring feature.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

9. Question 239 · 732 in bank

   Select 2

   A corporate cloud security policy states that communications between the company's VPC and KMS must travel entirely within the AWS network and not use public service endpoints. Which combination of the following actions MOST satisfies this requirement? (Choose two.)

   • AAdd the aws:sourceVpce condition to the AWS KMS key policy referencing the company's VPC endpoint ID.
   • BRemove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.
   • CCreate a VPC endpoint for AWS KMS with private DNS enabled.
   • DUse the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.
   • EAdd the following condition to the AWS KMS key policy: "aws:SourceIp": "10.0.0.0/16".

   Show answer

   Answer: AC

   Next question

10. Question 240 · 732 in bank

    A company has a requirement that no Amazon EC2 security group can allow SSH access from the CIDR block 0.0.0.0/0. The company wants to monitor compliance with this requirement at all times and wants to receive a near-real-time notification if any security group is noncompliant. A security engineer has configured AWS Config and will use the restricted-ssh managed rule to monitor the security groups. What should the security engineer do next to meet these requirements?

    • AConfigure AWS Config to send its configuration snapshots to an Amazon S3 bucket. Create an AWS Lambda function to run on a PutEvent to the S3 bucket. Configure the Lambda function to parse the snapshot for a compliance change to the restricted-ssh managed rule. Configure the Lambda function to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic if a change is discovered.
    • BConfigure an Amazon EventBridge event rule that is invoked by a compliance change event from AWS Config for the restricted-ssh managed rule. Configure the event rule to target an Amazon Simple Notification Service (Amazon SNS) topic that will provide a notification.
    • CConfigure AWS Config to push all its compliance notifications to Amazon CloudWatch Logs. Configure a CloudWatch Logs metric filter on the AWS Config log group to look for a compliance notification change on the restricted-ssh managed rule. Create an Amazon CloudWatch alarm on the metric filter to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic if the alarm is in the ALARM state.
    • DConfigure an Amazon CloudWatch alarm on the CloudWatch metric for the restricted-ssh managed rule. Configure the CloudWatch alarm to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic if the alarm is in the ALARM state.

    Show answer

    Answer: B

    References

    • repost.aws documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 231. 732 questions available.