SCS-C02 practice questions 291–300

1. Question 291 · 732 in bank

   Select 3

   A medical company recently completed an acquisition and inherited an existing AWS environment. The company has an upcoming audit and is concerned about the compliance posture of its acquisition. The company must identify personal health information inside Amazon S3 buckets and must identify S3 buckets that are publicly accessible. The company needs to prepare for the audit by collecting evidence in the environment. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)

   • AEnable Amazon Macie. Run an on-demand sensitive data discovery job that uses the PERSONAL_INFORMATION managed data identifier.
   • BUse AWS Glue with the Detect PII transform to identify sensitive data and to mask the sensitive data.
   • CEnable AWS Audit Manager. Create an assessment by using a supported framework.
   • DEnable Amazon GuardDuty S3 Protection. Document any findings that are related to suspicious access of S3 buckets.
   • EEnable AWS Security Hub. Use the AWS Foundational Security Best Practices standard. Review the controls dashboard for evidence of failed S3 Block Public Access controls.
   • FEnable AWS Config. Set up the s3-bucket-public-write-prohibited AWS Config managed rule.

   Show answer

   Answer: ACE

   Explanation

   A. Amazon Macie specializes in discovering sensitive data, such as personal health information, within your S3 buckets. This directly addresses the need to identify such data. C. AWS Audit Manager helps you create assessments and gather evidence based on compliance frameworks, preparing you thoroughly for the audit. E. AWS Security Hub provides a consolidated view of your security posture and identifies public access issues for S3 buckets, helping you review and document compliance with best practices.

   Source: Adapted from community discussion — IPLogic

   References

   • AWS documentation

   Next question

2. Question 292 · 732 in bank

   A Security Architect has been asked to review an existing security architecture and identity why the application servers cannot successfully initiate a connection to the database servers. The following summary describes the architecture: 1. An Application Load Balancer, an internet gateway and a NAT gateway are configured in the pubic subnet. 2. Database, application, and web servers are configured on three different private subnets. 3. The VPC has two route tables: one for the public subnet and one for all other subnets. The route table for the public subnet has a 0.0.0.0/0 route to the internet gateway. The route table for all other subnets has a 0.0.0.0/0 route to the NAT gateway. All private subnets can route to each other. 4. Each subnet has a network ACL implemented that limits all inbound and outbound connectivity to only the required ports and protocols. 5. There are 3 Security Groups (SGs): database, application, and web. Each group limits all inbound and outbound connectivity to the minimum required. Which of the following accurately reflects the access control mechanisms the Architect should verify?

   • AOutbound SG configuration on database servers Inbound SG configuration on application servers Inbound and outbound network ACL configuration on the database subnet Inbound and outbound network ACL configuration on the application server subnet
   • BInbound SG configuration on database servers Outbound SG configuration on application servers Inbound and outbound network ACL configuration on the database subnet Inbound and outbound network ACL configuration on the application server subnet
   • CInbound and outbound SG configuration on database servers Inbound and outbound SG configuration on application servers Inbound network ACL configuration on the database subnet Outbound network ACL configuration on the application server subnet
   • DInbound SG configuration on database servers Outbound SG configuration on application servers Inbound network ACL configuration on the database subnet Outbound network ACL configuration on the application server subnet

   Show answer

   Answer: B

   Next question

3. Question 293 · 732 in bank

   Select 3

   A company finds that one of its Amazon EC2 instances suddenly has a high CPU usage. The company does not know whether the EC2 instance is compromised or whether the operating system is performing background cleanup. Which combination of steps should a security engineer take before investigating the issue? (Choose three.)

   • ADisable termination protection for the EC2 instance if termination protection has not been disabled.
   • BEnable termination protection for the EC2 instance if termination protection has not been enabled.
   • CTake snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance.
   • DRemove all snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance.
   • ECapture the EC2 instance metadata, and then tag the EC2 instance as under quarantine.
   • FImmediately remove any entries in the EC2 instance metadata that contain sensitive information.

   Show answer

   Answer: BCE

   Explanation

   B. Enable termination protection for the EC2 instance if termination protection has not been enabled. This prevents accidental termination of the instance during the investigation. C. Take snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance. Creating snapshots ensures that you have a backup of the current state of your data volumes, which is crucial for forensic analysis. E. Capture the EC2 instance metadata, and then tag the EC2 instance as under quarantine. Capturing metadata provides information about the instance that could be useful during the investigation, and tagging the instance helps in tracking and managing the investigation process.

   Source: Adapted from community discussion — IPLogic

   Next question

4. Question 294 · 732 in bank

   Select 2

   Developers in an organization have moved from a standard application deployment to containers. The Security Engineer is tasked with ensuring that containers are secure. Which strategies will reduce the attack surface and enhance the security of the containers? (Choose two.)

   • AUse the containers to automate security deployments.
   • BLimit resource consumption (CPU, memory), networking connections, ports, and unnecessary container libraries.
   • CSegregate container by host, function, and data classification.
   • DUse Docker Notary framework to sign task definitions.
   • EEnable container breakout at the host kernel.

   Show answer

   Answer: BC

   Next question

5. Question 295 · 732 in bank

   A company hosts a web application on an Apache web server. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The company configured the EC2 instances to send the Apache web server logs to an Amazon CloudWatch Logs group that the company has configured to expire after 1 year. Recently, the company discovered in the Apache web server logs that a specific IP address is sending suspicious requests to the web application. A security engineer wants to analyze the past week of Apache web server logs to determine how many requests that the IP address sent and the corresponding URLs that the IP address requested. What should the security engineer do to meet these requirements with the LEAST effort?

   • AExport the CloudWatch Logs group data to Amazon S3. Use Amazon Macie to query the logs for the specific IP address and the requested URL.
   • BConfigure a CloudWatch Logs subscription to stream the log group to an Amazon OpenSearch Service cluster. Use OpenSearch Service to analyze the logs for the specific IP address and the requested URLs.
   • CUse CloudWatch Logs Insights and a custom query syntax to analyze the CloudWatch logs for the specific IP address and the requested URLs.
   • DExport the CloudWatch Logs group data to Amazon S3. Use AWS Glue to crawl the S3 bucket for only the log entries that contain the specific IP address. Use AWS Glue to view the results.

   Show answer

   Answer: C

   Explanation

   The correct answer here is C. Please check the Queries for Apache server logs section of the following document - https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax-examples.html

   Source: Adapted from community discussion — AgboolaKun

   References

   • AWS documentation

   Next question

6. Question 296 · 732 in bank

   Auditors for a health care company have mandated that all data volumes be encrypted at rest. Infrastructure is deployed mainly via AWS CloudFormation; however, third-party frameworks and manual deployment are required on some legacy systems. What is the BEST way to monitor, on a recurring basis, whether all EBS volumes are encrypted?

   • AOn a recurring basis, update all IAM user policies to require that EC2 instances are created with an encrypted volume.
   • BConfigure an AWS Config rule to run on a recurring basis for volume encryption.
   • CSet up Amazon Inspector rules for volume encryption to run on a recurring schedule.
   • DUse CloudWatch Logs to determine whether instances were created with an encrypted volume.

   Show answer

   Answer: B

   Next question

7. Question 297 · 732 in bank

   A company is implementing a customized notification solution to detect repeated unauthorized authentication attempts to bastion hosts. The company’s security engineer needs to implement a solution that will provide notification when 5 failed attempts occur within a 5-minute period. The solution must use native AWS services and must notify only the designated system administrator who is assigned to the specific bastion host. Which solution will meet these requirements?

   • AUse the Amazon CloudWatch agent to collect operating system logs. Use Amazon EventBridge to configure an alarm based on a metric filter for failed login attempts. Send an alert to Amazon Simple Notification Service (Amazon SNS) when the defined threshold for the alarm is exceeded. Use Amazon EC2 instance tags to determine which SNS topics receive notifications.
   • BUse AWS Systems Manager Agent to collect operating system logs. Use the Systems Manager Run Command AWS-ConfigureCloudWatch document to configure an Amazon EventBridge event based on a metric filter for failed login attempts. Send an alert to Amazon Simple Notification Service (Amazon SNS) when the defined threshold for the alarm is exceeded. Use SNS messaging filters to control who receives notifications.
   • CUse the Amazon CloudWatch agent to collect operating system logs. Create a CloudWatch alarm based on a metric filter for failed login attempts. Send an alert to Amazon Simple Notification Servige (Amazon SNS) when the defined threshold for the alarm is exceeded. Use SNS messaging filters to control who receives notifications.
   • DUse AWS Systems Manager Agent to collect operating system logs. Use the Systems Manager Run Command AWS-ConfigureCloudWatch document to configure an Amazon CloudWatch alarm based on a metric filter for failed login attempts. Send an alert to Amazon Simple Notification Service (Amazon SNS) when the defined threshold for the alarm is exceeded. Use EC2 instance tags to determine which SNS topics receive notifications.

   Show answer

   Answer: C

   Next question

8. Question 298 · 732 in bank

   A company became aware that one of its access keys was exposed on a code sharing website 11 days ago. A Security Engineer must review all use of the exposed keys to determine the extent of the exposure. The company enabled AWS CloudTrail in all regions when it opened the account. Which of the following will allow the Security Engineer to complete the task?

   • AFilter the event history on the exposed access key in the CloudTrail console. Examine the data from the past 11 days.
   • BUse the AWS CLI to generate an IAM credential report. Extract all the data from the past 11 days.
   • CUse Amazon Athena to query the CloudTrail logs from Amazon S3. Retrieve the rows for the exposed access key for the past 11 days.
   • DUse the Access Advisor tab in the IAM console to view all of the access key activity for the past 11 days.

   Show answer

   Answer: A

   Next question

9. Question 299 · 732 in bank

   Select 2

   An ecommerce website was down for 1 hour following a DDoS attack. Users were unable to connect to the website during the attack period. The ecommerce company’s security team is worried about future potential attacks and wants to prepare for such events. The company needs to minimize downtime in its response to similar attacks in the future. Which steps would help achieve this? (Choose two.)

   • AEnable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.
   • BSubscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack.
   • CUse VPC Flow Logs to monitor network traffic and an AWS Lambda function to automatically block an attacker’s IP using security groups.
   • DSet up an Amazon EventBridge rule to monitor the AWS CloudTrail events in real time, use AWS Config rules to audit the configuration, and use AWS Systems Manager for remediation.
   • EUse AWS WAF to create rules to respond to such attacks.

   Show answer

   Answer: BE

   Explanation

   B. Provides enhanced protection against DDoS attacks, including advanced mitigation capabilities. Includes 24/7 access to the AWS DDoS Response Team (DRT) for immediate assistance during an attack. Also provides cost protection to prevent unexpected charges due to scaling during a DDoS attack. E. AWS WAF can help create custom rules to detect and block malicious traffic patterns (e.g., rate-based rules, IP address blocking, or patterns indicative of DDoS). It integrates with AWS Shield and CloudFront for real-time traffic filtering. By setting up rate-limiting rules, WAF can help mitigate volumetric attacks.

   Source: Adapted from community discussion — TareDHakim

   Next question

10. Question 300 · 732 in bank

    Select 3

    A Development team has built an experimental environment to test a simple static web application. It has built an isolated VPC with a private and a public subnet. The public subnet holds only an Application Load Balancer, a NAT gateway, and an internet gateway. The private subnet holds all of the Amazon EC2 instances. There are 3 different types of servers. Each server type has its own Security Group that limits access to only required connectivity. The Security Groups have both inbound and outbound rules applied. Each subnet has both inbound and outbound network ACLs applied to limit access to only required connectivity. Which of the following should the team check if a server cannot establish an outbound connection to the internet? (Choose three.)

    • AThe route tables and the outbound rules on the appropriate private subnet security group.
    • BThe outbound network ACL rules on the private subnet and the inbound network ACL rules on the public subnet.
    • CThe outbound network ACL rules on the private subnet and both the inbound and outbound rules on the public subnet.
    • DThe rules on any host-based firewall that may be applied on the Amazon EC2 instances.
    • EThe Security Group applied to the Application Load Balancer and NAT gateway.
    • FThat the 0.0.0.0/0 route in the private subnet route table points to the Internet gateway in the public subnet.

    Show answer

    Answer: ACD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 291. 732 questions available.