SCS-C02 practice questions 251–260

1. Question 251 · 732 in bank

   An Amazon EC2 instance is denied access to a newly created AWS KMS CMK used for decrypt actions. The environment has the following configuration: ✑ The instance is allowed the kms:Decrypt action in its IAM role for all resources ✑ The AWS KMS CMK status is set to enabled ✑ The instance can communicate with the KMS API using a configured VPC endpoint What is causing the issue?

   • AThe kms:GenerateDataKey permission is missing from the EC2 instance's IAM role
   • BThe ARN tag on the CMK contains the EC2 instance's ID instead of the instance's ARN
   • CThe kms:Encrypt permission is missing from the EC2 IAM role
   • DThe KMS CMK key policy that enables IAM user permissions is missing

   Show answer

   Answer: D

   Next question

2. Question 252 · 732 in bank

   A company has enabled Amazon GuardDuty in all Regions as part of its security monitoring strategy. In one of the VPCs, the company hosts an Amazon EC2 instance working as an FTP server that is contacted by a high number of clients from multiple locations. This is identified by GuardDuty as a brute force attack due to the high number of connections that happen every hour. The finding has been flagged as a false positive. However, GuardDuty keeps raising the issue. A Security Engineer has been asked to improve the signal-to-noise ratio. The Engineer needs to ensure that changes do not compromise the visibility of potential anomalous behavior. How can the Security Engineer address the issue?

   • ADisable the FTP rule in GuardDuty in the Region where the FTP server is deployed
   • BAdd the FTP server to a trusted IP list and deploy it to GuardDuty to stop receiving the notifications
   • CUse GuardDuty filters with auto archiving enabled to close the findings
   • DCreate an AWS Lambda function that closes the finding whenever a new occurrence is reported

   Show answer

   Answer: C

   Next question

3. Question 253 · 732 in bank

   A security engineer creates an Amazon S3 bucket policy that denies access to all users. A few days later, the security engineer adds an additional statement to the bucket policy to allow read-only access to one other employee. Even after updating the policy, the employee sill receives an access denied message. What is the likely cause of this access denial?

   • AThe ACL in the bucket needs to be updated.
   • BThe IAM policy does not allow the user to access the bucket.
   • CIt takes a few minutes for a bucket policy to take effect.
   • DThe allow permission is being overridden by the deny.

   Show answer

   Answer: D

   References

   • AWS documentation

   Next question

4. Question 254 · 732 in bank

   Select 2

   What are the MOST secure ways to protect the AWS account root user of a recently opened AWS account? (Choose two.)

   • AUse the AWS account root user access keys instead of the AWS Management Console
   • BEnable multi-factor authentication for the AWS IAM users with the AdministratorAccess managed policy attached to them
   • CEnable multi-factor authentication for the AWS account root user
   • DUse AWS KMS to encrypt all AWS account root user and AWS IAM access keys and set automatic rotation to 30 days
   • EDo not create access keys for the AWS account root user; instead, create AWS IAM users

   Show answer

   Answer: CE

   Next question

5. Question 255 · 732 in bank

   A company needs to securely deploy resources and workloads across AWS accounts. The accounts are in an organization in AWS Organizations. The company needs to use AWS CloudFormation for infrastructure as code (IaC) management of approved architectural patterns. The company also must enforce tagging requirements and specific guidelines for resource and workload configuration and creation. Which solution will meet these requirements?

   • AUse CloudFormation stack policies to prevent the creation of resources that do not meet the tagging or configuration requirements. Use Amazon EventBridge rules to detect API calls that attempt to create resources outside of CloudFormation.
   • BUse an AWS CodePipeline pipeline to test and deploy IaC defined workloads through CloudFormation into the accounts. Use AWS Config rules to enforce the tagging requirements. Apply an SCP to prevent the creation of misconfigured resources in all OUs.
   • CCreate an IAM permissions boundary to prevent the creation of misconfigured resources through CloudFormation and to enforce the tagging requirements. Apply the permissions boundary to all account roles. Use AWS Config rules to identify existing resources that are in a misconfigured state.
   • DUse AWS Service Catalog with CloudFormation to manage access to approved architecture configurations. Provision Service Catalog portfolios to the accounts across the organization. Use AWS Config rules to enforce the tagging requirements and other resource configuration policies across accounts.

   Show answer

   Answer: D

   Next question

6. Question 256 · 732 in bank

   A company has decided to migrate sensitive documents from on-premises data centers to Amazon S3. Currently, the hard drives are encrypted to meet a compliance requirement regarding data encryption. The CISO wants to improve security by encrypting each file using a different key instead of a single key. Using a different key would limit the security impact of a single exposed key. Which of the following requires the LEAST amount of configuration when implementing this approach?

   • APlace each file into a different S3 bucket. Set the default encryption of each bucket to use a different AWS KMS customer managed key.
   • BPut all the files in the same S3 bucket. Using S3 events as a trigger, write an AWS Lambda function to encrypt each file as it is added using different AWS KMS data keys.
   • CUse the S3 encryption client to encrypt each file individually using S3-generated data keys.
   • DPlace all the files in the same S3 bucket. Use server-side encryption with AWS KMS-managed keys (SSE-KMS) to encrypt the data.

   Show answer

   Answer: D

   Next question

7. Question 257 · 732 in bank

   A company is migrating its Amazon EC2 based applications to use Instance Metadata Service Version 2 (IMDSv2). A security engineer needs to determine whether any of the EC2 instances are still using Instance Metadata Service Version 1 (IMDSv1). What should the security engineer do to confirm that the IMDSv1 endpoint is no longer being used?

   • AConfigure logging on the Amazon CloudWatch agent for IMDSv1 as part of EC2 instance startup. Create a metric filter and a CloudWatch dashboard. Track the metric in the dashboard.
   • BCreate an Amazon CloudWatch dashboard. Verify that the EC2:MetadataNoToken metric is zero across all EC2 instances. Monitor the dashboard.
   • CCreate a security group that blocks access to HTTP for the IMDSv1 endpoint. Attach the security group to all EC2 instances.
   • DConfigure user data scripts for all EC2 instances to send logging information to AWS CloudTrail when IMDSV1 is used. Create a metric filter and an Amazon CloudWatch dashboard. Track the metric in the dashboard.

   Show answer

   Answer: B

   Next question

8. Question 258 · 732 in bank

   A company has an encrypted Amazon S3 bucket. An Application Developer has an IAM policy that allows access to the S3 bucket, but the Application Developer is unable to access objects within the bucket. What is a possible cause of the issue?

   • AThe S3 ACL for the S3 bucket fails to explicitly grant access to the Application Developer
   • BThe AWS KMS key for the S3 bucket fails to list the Application Developer as an administrator
   • CThe S3 bucket policy fails to explicitly grant access to the Application Developer
   • DThe S3 bucket policy explicitly denies access to the Application Developer

   Show answer

   Answer: D

   Next question

9. Question 259 · 732 in bank

   A company is planning to create an organization by using AWS Organizations. The company needs to integrate user management with the company’s external identity provider (IdP). The company also needs to centrally manage access to all of its AWS accounts and applications from the organization’s management account. Which solution will meet these requirements?

   • AConfigure AWS Directory Service with the external IdP. Create IAM policies and associate them with users from the external IdP.
   • BEnable AWS IAM Identity Center and use the external IdP as the identity source. Create permission sets and account assignments by using IAM Identity Center.
   • CConfigure AWS Identity and Access Management (IAM) to use the external IdP as an IdP. Create IAM policies and associate them with users from the external IdP.
   • DEnable Amazon Cognito in the organization’s management account. Create an identity pool and associate it with the external IdP. Create IAM roles and associate them with the identity pool.

   Show answer

   Answer: B

   Explanation

   The best solution for integrating user management with an external identity provider (IdP) and centrally managing access to all AWS accounts and applications is B. Enable AWS IAM Identity Center and use the external IdP as the identity source. Create permission sets and account assignments by using IAM Identity Center. AWS IAM Identity Center (formerly AWS Single Sign-On) allows you to connect your external IdP, such as Okta or Microsoft Entra ID, using SAML 2.0 or SCIM protocols1. This setup enables centralized management of user access across all AWS accounts and applications within your organization

   Source: Adapted from community discussion — IPLogic

   Next question

10. Question 260 · 732 in bank

    Select 2

    A Web Administrator for the website example.com has created an Amazon CloudFront distribution for dev.example.com, with a requirement to configure HTTPS using a custom TLS certificate imported to AWS Certificate Manager. Which combination of steps is required to ensure availability of the certificate in the CloudFront console? (Choose two.)

    • ACall UploadServerCertificate with /cloudfront/dev/ in the path parameter.
    • BImport the certificate with a 4,096-bit RSA public key.
    • CEnsure that the certificate, private key, and certificate chain are PKCS #12-encoded.
    • DImport the certificate in the us-east-1 (N. Virginia) Region.
    • EEnsure that the certificate, private key, and certificate chain are PEM-encoded.

    Show answer

    Answer: DE

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 251. 732 questions available.