SCS-C02 practice questions 21–30

1. Question 21 · 732 in bank

   A security engineer recently rotated all IAM access keys in an AWS account. The security engineer then configured AWS Config and enabled the following AWS Config managed rules: mfa-enabled-for-iam-console-access, iam-user-mfa-enabled, access-keys-rotated, and iam-user-unused-credentials-check. The security engineer notices that all resources are displaying as noncompliant after the IAM GenerateCredentialReport API operation is invoked. What could be the reason for the noncompliant status?

   • AThe IAM credential report was generated within the past 4 hours.
   • BThe security engineer does not have the GenerateCredentialReport permission.
   • CThe security engineer does not have the GetCredenlialReport permission.
   • DThe AWS Config rules have a MaximumExecutionFrequency value of 24 hours.

   Show answer

   Answer: A

   Explanation

   When these AWS Config rules are triggered, they rely on the latest IAM credential report to evaluate compliance. If the IAM credential report has been generated within the past 4 hours, it might not reflect the most recent changes, such as the rotation of access keys. To address this, it's a good practice to ensure that the IAM credential report is generated and updated at regular intervals, and AWS Config rules are then evaluated against the most recent report. You can schedule the generation of the IAM credential report and the evaluation of AWS Config rules accordingly. A &C are incorrect because the noncompliance is related to the timeliness of the IAM credential report rather than permissions. Option D is incorrect because the MaximumExecutionFrequency value doesn't affect the initial evaluation of the rules; it determines how often the rule is re-evaluated after its first evaluation.

   Source: Adapted from community discussion — vikasj1in

   References

   • repost.aws documentation
   • AWS documentation

   Next question

2. Question 22 · 732 in bank

   A company has a customer master key (CMK) with imported key materials. Company policy requires that all encryption keys must be rotated every year. What can be done to implement the above policy?

   • AEnable automatic key rotation annually for the CMK.
   • BUse AWS Command Line Interface to create an AWS Lambda function to rotate the existing CMK annually.
   • CImport new key material to the existing CMK and manually rotate the CMK.
   • DCreate a new CMK, import new key material to it, and point the key alias to the new CMK.

   Show answer

   Answer: D

   Next question

3. Question 23 · 732 in bank

   A company wants to receive an email notification about critical findings in AWS Security Hub. The company does not have an existing architecture that supports this functionality. Which solution will meet the requirement?

   • ACreate an AWS Lambda function to identify critical Security Hub findings. Create an Amazon Simple Notification Service (Amazon SNS) topic as the target of the Lambda function. Subscribe an email endpoint to the SNS topic to receive published messages.
   • BCreate an Amazon Kinesis Data Firehose delivery stream. Integrate the delivery stream with Amazon EventBridge. Create an EventBridge rule that has a filter to detect critical Security Hub findings. Configure the delivery stream to send the findings to an email address.
   • CCreate an Amazon EventBridge rule to detect critical Security Hub findings. Create an Amazon Simple Notification Service (Amazon SNS) topic as the target of the EventBridge rule. Subscribe an email endpoint to the SNS topic to receive published messages.
   • DCreate an Amazon EventBridge rule to detect critical Security Hub findings. Create an Amazon Simple Email Service (Amazon SES) topic as the target of the EventBridge rule. Use the Amazon SES API to format the message. Choose an email address to be the recipient of the message.

   Show answer

   Answer: C

   Explanation

   D - Eventbridge is essentially like SNS in this example -'Amazon Simple Notification Service (SNS) and Amazon EventBridge are both AWS services that help with data processing and messaging [of events.]' So then working directly with SMS is more efficient. And YES Eventbridge CAN work with SMS with just the same amount of effort but one less step of redundancy.

   Source: Adapted from community discussion — hro

   References

   • AWS documentation

   Next question

4. Question 24 · 732 in bank

   A water utility company uses a number of Amazon EC2 instances to manage updates to a fleet of 2,000 Internet of Things (IoT) field devices that monitor water quality. These devices each have unique access credentials. An operational safety policy requires that access to specific credentials is independently auditable. What is the MOST cost-effective way to manage the storage of credentials?

   • AUse AWS Systems Manager to store the credentials as Secure Strings Parameters. Secure by using an AWS KMS key.
   • BUse AWS Key Management System to store a master key, which is used to encrypt the credentials. The encrypted credentials are stored in an Amazon RDS instance.
   • CUse AWS Secrets Manager to store the credentials.
   • DStore the credentials in a JSON file on Amazon S3 with server-side encryption.

   Show answer

   Answer: A

   Next question

5. Question 25 · 732 in bank

   A company is using AWS WAF to protect a customized public API service that is based on Amazon EC instances. The API uses an Application Load Balancer. The AWS WAF web ACL is configured with an AWS Managed Rules rule group. After a software upgrade to the API and the client application, some types of requests are no longer working and are causing application stability issues. A security engineer discovers that AWS WAF logging is not turned on for the web ACL. The security engineer needs to immediately return the application to service, resolve the issue, and ensure that logging is not turned off in the future. The security engineer turns on logging for the web ACL and specifies Amazon CloudWatch Logs as the destination. Which additional set of steps should the security engineer take to meet the requirements?

   • AEdit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs.
   • BEdit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the AWS WAF resource policy so that AWS WAF administrators cannot remove the logging configuration for any AWS WAF web ACLs.
   • CEdit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs to determine which rule is blocking the request. Modify the AWS WAF resource policy so that AWS WAF administrators cannot remove the logging configuration for any AWS WAF web ACLs.
   • DEdit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs.

   Show answer

   Answer: A

   Explanation

   As many have suggested of why i'ts unnecessary to go for 'challenge' so C&D -> OUT As of why not picking B(resource-based) is because resource policy would only control access to that single web ACL. The question asks to ensure logging is not turned off for any web ACLs[well that's what's implied], which modifying IAM policies globally achieves but modifying a single resource policy does not. AWS documentation recommends applying least privilege permissions through IAM policies when managing access to resources across multiple accounts. This helps ensure permissions are restricted at the identity level rather than at the individual resource level.

   Source: Adapted from community discussion — yorkicurke

   References

   • AWS documentation

   Next question

6. Question 26 · 732 in bank

   Select 2

   An organization is using Amazon CloudWatch Logs with agents deployed on its Linux Amazon EC2 instances. The agent configuration files have been checked and the application log files to be pushed are configured correctly. A review has identified that logging from specific instances is missing. Which steps should be taken to troubleshoot the issue? (Choose two.)

   • AUse an EC2 run command to confirm that the ג€awslogsג€ service is running on all instances.
   • BVerify that the permissions used by the agent allow creation of log groups/streams and to put log events.
   • CCheck whether any application log entries were rejected because of invalid time stamps by reviewing /var/cwlogs/rejects.log.
   • DCheck that the trust relationship grants the service ג€cwlogs.amazonaws.comג€ permission to write objects to the Amazon S3 staging bucket.
   • EVerify that the time zone on the application servers is in UTC.

   Show answer

   Answer: AB

   Next question

7. Question 27 · 732 in bank

   Select 2

   A security engineer is creating an AWS Lambda function. The Lambda function needs to use a role that is named LambdaAuditRole to assume a role that is named AcmeAuditFactoryRole in a different AWS account. When the code is processed, the following error message appears: "An error occurred (AccessDenied) when calling the AssumeRole operation." Which combination of steps should the security engineer take to resolve this error? (Choose two.)

   • AEnsure that LambdaAuditRole has the sts:AssumeRole permission for AcmeAuditFactoryRole.
   • BEnsure that LambdaAuditRole has the AWSLambdaBasicExecutionRole managed policy attached.
   • CEnsure that the trust policy for AcmeAuditFactoryRole allows the sts:AssumeRole action from LambdaAuditRole.
   • DEnsure that the trust policy for LambdaAuditRole allows the sts:AssumeRole action from the lambda.amazonaws.com service.
   • EEnsure that the sts:AssumeRole API call is being issued to the us-east-1 Region endpoint.

   Show answer

   Answer: AC

   References

   • repost.aws documentation

   Next question

8. Question 28 · 732 in bank

   A Security Engineer must design a solution that enables the incident Response team to audit for changes to a user's IAM permissions in the case of a security incident. How can this be accomplished?

   • AUse AWS Config to review the IAM policy assigned to users before and after the incident.
   • BRun the GenerateCredentialReport via the AWS CLI, and copy the output to Amazon S3 daily for auditing purposes.
   • CCopy AWS CloudFormation templates to S3, and audit for changes from the template.
   • DUse Amazon EC2 Systems Manager to deploy images, and review AWS CloudTrail logs for changes.

   Show answer

   Answer: A

   Next question

9. Question 29 · 732 in bank

   Select 2

   A company has AWS accounts in an organization in AWS Organizations. The organization includes a dedicated security account. All AWS account activity across all member accounts must be logged and reported to the dedicated security account. The company must retain all the activity logs in a secure storage location within the dedicated security account for 2 years. No changes or deletions of the logs are allowed. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)

   • AIn the dedicated security account, create an Amazon S3 bucket. Configure S3 Object Lock in compliance mode and a retention period of 2 years on the S3 bucket. Set the bucket policy to allow the organization's management account to write to the S3 bucket.
   • BIn the dedicated security account, create an Amazon S3 bucket. Configure S3 Object Lock in compliance mode and a retention period of 2 years on the S3 bucket. Set the bucket policy to allow the organization's member accounts to write to the S3 bucket.
   • CIn the dedicated security account, create an Amazon S3 bucket that has an S3 Lifecycle configuration that expires objects after 2 years. Set the bucket policy to allow the organization's member accounts to write to the S3 bucket.
   • DCreate an AWS CloudTrail trail for the organization. Configure logs to be delivered to the logging Amazon S3 bucket in the dedicated security account.
   • ETurn on AWS CloudTrail in each account. Configure logs to be delivered to an Amazon S3 bucket that is created in the organization's management account. Forward the logs to the S3 bucket in the dedicated security account by using AWS Lambda and Amazon Kinesis Data Firehose.

   Show answer

   Answer: BD

   Explanation

   I go with BD, because each Member Account has to write into the security Account S3 bucket, not only the Organization Management Account. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-set-bucket-policy-for-multiple-accounts.html

   Source: Adapted from community discussion — ahrentom

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 30 · 732 in bank

    A company has complex connectivity rules governing ingress, egress, and communications between Amazon EC2 instances. The rules are so complex that they cannot be implemented within the limits of the maximum number of security groups and network access control lists (network ACLs). What mechanism will allow the company to implement all required network rules without incurring additional cost?

    • AConfigure AWS WAF rules to implement the required rules.
    • BUse the operating system built-in, host-based firewall to implement the required rules.
    • CUse a NAT gateway to control ingress and egress according to the requirements.
    • DLaunch an EC2-based firewall product from the AWS Marketplace, and implement the required rules in that product.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 21. 732 questions available.