SCS-C02 practice questions 261–270

1. Question 261 · 732 in bank

   A company uses Amazon Elastic Container Registry (Amazon ECR) as the repository for its production applications. A security engineer must implement an automated solution to report any vulnerabilities that ECR enhanced scanning detects. The solution must provide notification of vulnerability findings in an instant message to the company’s Slack account Which solution will meet these requirements with the MOST operational efficiency?

   • AActivate Amazon Inspector scans for the ECR repository. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure an AWS Chatbot client for Slack that consumes the SNS topic. Create an Amazon EventBridge rule for Amazon Inspector findings. Specify the SNS topic as the target for the rule.
   • BActivate Amazon Inspector scans for the ECR repository. Write a script to use AWS CLI commands to retrieve image scan findings from Amazon Inspector. Configure the script to send the findings to a Slack endpoint. Launch an Amazon EC2 instance to run the script.
   • CActivate Amazon Inspector scans for the ECR repository. Create an AWS Step Functions state machine. Set a first step in the state machine to call the Amazon Inspector ListFindings API operation. Create an Amazon Simple Notification Service (Amazon SNS) topic with Slack as the target. Add a second step in the state machine to call the Amazon SNS Publish API operation.
   • DActivate AWS Security Hub scans for the ECR repository. Create a custom action in Security Hub for findings. Define an Amazon EventBridge rule for the custom action. Configure the EventBridge rule to redirect the findings to a Slack channel.

   Show answer

   Answer: A

   Explanation

   The most operationally efficient solution is A. Activate Amazon Inspector scans for the ECR repository. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure an AWS Chatbot client for Slack that consumes the SNS topic. Create an Amazon EventBridge rule for Amazon Inspector findings. Specify the SNS topic as the target for the rule.

   Source: Adapted from community discussion — IPLogic

   Next question

2. Question 262 · 732 in bank

   A Security Engineer has discovered that, although encryption was enabled on the Amazon S3 bucket examplebucket, anyone who has access to the bucket has the ability to retrieve the files. The Engineer wants to limit access to each IAM user can access an assigned folder only. What should the Security Engineer do to achieve this?

   • AUse envelope encryption with the AWS-managed CMK aws/s3.
   • BCreate a customer-managed CMK with a key policy granting ג€kms:Decryptג€ based on the ג€${aws:username}ג€ variable.
   • CCreate a customer-managed CMK for each user. Add each user as a key user in their corresponding key policy.
   • DChange the applicable IAM policy to grant S3 access to ג€Resourceג€: ג€arn:aws:s3:::examplebucket/${aws:username}/*ג€

   Show answer

   Answer: D

   Next question

3. Question 263 · 732 in bank

   A company uses AWS Config rules to identify Amazon S3 buckets that are not compliant with the company’s data protection policy. The S3 buckets are hosted in several AWS Regions and several AWS accounts. The accounts are in an organization in AWS Organizations. The company needs a solution to remediate the organization’s existing noncompliant S3 buckets and any noncompliant S3 buckets that are created in the future. Which solution will meet these requirements?

   • ADeploy an AWS Config aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.
   • BDeploy an AWS Config aggregator with organization-wide resource data aggregation. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
   • CDeploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.
   • DDeploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.

   Show answer

   Answer: A

   Next question

4. Question 264 · 732 in bank

   A Security Engineer manages AWS Organizations for a company. The Engineer would like to restrict AWS usage to allow Amazon S3 only in one of the organizational units (OUs). The Engineer adds the following SCP to the OU:

   

   The next day, API calls to AWS IAM appear in AWS CloudTrail logs in an account under that OU. How should the Security Engineer resolve this issue?

   • AMove the account to a new OU and deny IAM:* permissions.
   • BAdd a Deny policy for all non-S3 services at the account level.
   • CChange the policy to: //IMG//
   • DDetach the default FullAWSAccess SCP.

   Show answer

   Answer: D

   Next question

5. Question 265 · 732 in bank

   A company’s engineering team is developing a new application that creates AWS Key Management Service (AWS KMS) customer managed key grants for users. Immediately after a grant is created, users must be able to use the KMS key to encrypt a 512-byte payload. During load testing, AccessDeniedException errors occur occasionally when a user first attempts to use the key to encrypt. Which solution should the company’s security specialist recommend to eliminate these AccessDeniedException errors?

   • AInstruct users to implement a retry mechanism every 2 minutes until the call succeeds.
   • BInstruct the engineering team to consume a random grant token from users and to call the CreateGrant operation by passing the grant token to the operation. Instruct users to use that grant token in their call to encrypt.
   • CInstruct the engineering team to create a random name for the grant when calling the CreateGrant operation. Return the name to the users and instruct them to provide the name as the grant token in the call to encrypt.
   • DInstruct the engineering team to pass the grant token returned in the CreateGrant response to users. Instruct users to use that grant token in their call to encrypt.

   Show answer

   Answer: D

   Explanation

   D. The AWS KMS API follows an eventual consistency model. When you create a grant, the grant might not be effective immediately. To use the permissions in a new grant immediately, use the grant token for the grant. https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html

   Source: Adapted from community discussion — m_ch333

   References

   • AWS documentation

   Next question

6. Question 266 · 732 in bank

   Select 2

   A Developer is creating an AWS Lambda function that requires environment variables to store connection information and logging settings. The Developer is required to use an AWS KMS Customer Master Key (CMK) supplied by the Information Security department in order to adhere to company standards for securing Lambda environment variables. Which of the following are required for this configuration to work? (Choose two.)

   • AThe Developer must configure Lambda access to the VPC using the --vpc-config parameter.
   • BThe Lambda function execution role must have the kms:Decrypt permission added in the AWS IAM policy.
   • CThe KMS key policy must allow permissions for the Developer to use the KMS key.
   • DThe AWS IAM policy assigned to the Developer must have the kms:GenerateDataKey permission added.
   • EThe Lambda execution role must have the kms:Encrypt permission added in the AWS IAM policy.

   Show answer

   Answer: BC

   Next question

7. Question 267 · 732 in bank

   A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website is experiencing a global DDoS attack by a specific IoT device brand that has a unique user agent. A security engineer is creating an AWS WAF web ACL and will associate the web ACL with the ALB. The security engineer must implement a rule statement as part of the web ACL to block the requests. The rule statement must mitigate the current attack and future attacks from these IoT devices without blocking requests from customers. Which rule statement will meet these requirements?

   • AUse an IP set match rule statement that includes the IP address for IoT devices from the user agent.
   • BUse a geographic match rule statement. Configure the statement to block countries that the IoT devices are located in.
   • CUse a rate-based rule statement. Set a rate limit that is equal to the number of requests that are coming from the IoT devices.
   • DUse a string match rule statement that includes details of the IoT device brand from the user agent.

   Show answer

   Answer: D

   Next question

8. Question 268 · 732 in bank

   A Developer signed in to a new account within an AWS Organizations organizational unit (OU) containing multiple accounts. Access to the Amazon S3 service is restricted with the following SCP:

   

   How can the Security Engineer provide the Developer with Amazon S3 access without affecting other accounts?

   • AMove the SCP to the root OU of Organizations to remove the restriction to access Amazon S3.
   • BAdd an IAM policy for the Developer, which grants S3 access.
   • CCreate a new OU without applying the SCP restricting S3 access. Move the Developer account to this new OU.
   • DAdd an allow list for the Developer account for the S3 service.

   Show answer

   Answer: C

   Next question

9. Question 269 · 732 in bank

   A company has configured a gateway VPC endpoint in a VPC. Only Amazon EC2 instances that reside in a single subnet in the VPC can use the endpoint. The company has modified the route table for this single subnet to route traffic to Amazon S3 through the gateway VPC endpoint. The VPC provides internet access through an internet gateway. A security engineer attempts to use instance profile credentials from an EC2 instance to retrieve an object from the S3 bucket, but the attempt fails. The security engineer verifies that the EC2 instance has an IAM instance profile with the correct permissions to access the S3 bucket and to retrieve objects. The security engineer also verifies that the S3 bucket policy is allowing access properly. Additionally, the security engineer verifies that the EC2 instance’s security group and the subnet's network ACLs allow the communication. What else should the security engineer check to determine why the request from the EC2 instance is failing?

   • AVerify that the EC2 instance’s security group does not have an implicit inbound deny rule for Amazon S3.
   • BVerify that the VPC endpoint’s security group does not have an explicit inbound deny rule for the EC2 instance.
   • CVerify that the internet gateway is allowing traffic to Amazon S3.
   • DVerify that the VPC endpoint policy is allowing access to Amazon S3.

   Show answer

   Answer: D

   References

   • AWS documentation

   Next question

10. Question 270 · 732 in bank

    A company has several workloads running on AWS. Employees are required to authenticate using on-premises ADFS and SSO to access the AWS Management Console. Developers migrated an existing legacy web application to an Amazon EC2 instance. Employees need to access this application from anywhere on the internet, but currently, there is no authentication system built into the application. How should the Security Engineer implement employee-only access to this system without changing the application?

    • APlace the application behind an Application Load Balancer (ALB). Use Amazon Cognito as authentication for the ALB. Define a SAML-based Amazon Cognito user pool and connect it to ADFS.
    • BImplement AWS SSO in the master account and link it to ADFS as an identity provider. Define the EC2 instance as a managed resource, then apply an IAM policy on the resource.
    • CDefine an Amazon Cognito identity pool, then install the connector on the Active Directory server. Use the Amazon Cognito SDK on the application instance to authenticate the employees using their Active Directory user names and passwords.
    • DCreate an AWS Lambda custom authorizer as the authenticator for a reverse proxy on Amazon EC2. Ensure the security group on Amazon EC2 only allows access from the Lambda function.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 261. 732 questions available.