SCS-C02 practice questions 301–310

1. Question 301 · 732 in bank

   An AWS account includes two S3 buckets: bucket1 and bucket2. The bucket2 does not have a policy defined, but bucket1 has the following bucket policy:

   

   In addition, the same account has an IAM User named “alice”, with the following IAM policy.

   

   Which buckets can user “alice” access?

   • Abucket1 only
   • Bbucket2 only
   • CBoth bucket1 and bucket2
   • DNeither bucket1 nor bucket2

   Show answer

   Answer: C

   Explanation

   bucket1 has a policy that explicitly allows user "alice" access to arn:aws:s3:::bucket1/*. bucket2 has no bucket policy, but "alice"’s IAM policy allows access to arn:aws:s3:::bucket2/*. Here's the access situation: bucket1: User "alice" can access bucket1 because the bucket policy explicitly allows it. bucket2: User "alice" can access bucket2 because her IAM policy grants her permission to it, and there is no bucket policy to restrict this access. So, user "alice" can access both bucket1 and bucket2. Therefore, the correct answer is C. Both bucket1 and bucket2.

   Source: Adapted from community discussion — IPLogic

   References

   • AWS documentation

   Next question

2. Question 302 · 732 in bank

   Example.com is hosted on Amazon EC2 instance behind an Application Load Balancer (ALB). Third-party host intrusion detection system (HIDS) agents that capture the traffic of the EC2 instance are running on each host. The company must ensure they are using privacy enhancing technologies for users, without losing the assurance the third-party solution offers. What is the MOST secure way to meet these requirements?

   • AEnable TLS pass through on the ALB, and handle decryption at the server using Elliptic Curve Diffie-Hellman (ECDHE) cipher suites.
   • BCreate a listener on the ALB that uses encrypted connections with Elliptic Curve Diffie-Hellman (ECDHE) cipher suites, and pass the traffic in the clear to the server.
   • CCreate a listener on the ALB that uses encrypted connections with Elliptic Curve Diffie-Hellman (ECDHE) cipher suites, and use encrypted connections to the servers that do not enable Perfect Forward Secrecy (PFS).
   • DCreate a listener on the ALB that does not enable Perfect Forward Secrecy (PFS) cipher suites, and use encrypted connections to the servers using Elliptic Curve Diffie-Hellman (ECDHE) cipher suites.

   Show answer

   Answer: C

   Next question

3. Question 303 · 732 in bank

   A company plans to create Amazon S3 buckets to store log data. All the S3 buckets will have versioning enabled and will use the S3 Standard storage class. A security engineer needs to implement a solution that protects objects in the S3 buckets from deletion for 90 days. The solution must ensure that no object can be deleted during this time period, even by an administrator or the AWS account root user. Which solution will meet these requirements?

   • AEnable S3 Object Lock in governance mode. Set a legal hold of 90 days.
   • BEnable S3 Object Lock in governance mode. Set a retention period of 90 days.
   • CEnable S3 Object Lock in compliance mode. Set a retention period of 90 days.
   • DCreate an S3 Glacier Vault Lock policy that prevents deletion for 90 days.

   Show answer

   Answer: C

   Next question

4. Question 304 · 732 in bank

   Select 3

   A Website currently runs on Amazon EC2, with mostly static content on the site. Recently, the site was subjected to a DDoS attack, and a Security Engineer was tasked with redesigning the edge security to help mitigate this risk in the future. What are some ways the Engineer could achieve this? (Choose three.)

   • AUse AWS X-Ray to inspect the traffic going to the EC2 instances.
   • BMove the static content to Amazon S3, and front this with an Amazon CloudFront distribution.
   • CChange the security group configuration to block the source of the attack traffic.
   • DUse AWS WAF security rules to inspect the inbound traffic.
   • EUse Amazon Inspector assessment templates to inspect the inbound traffic.
   • FUse Amazon Route 53 to distribute traffic.

   Show answer

   Answer: BDF

   Next question

5. Question 305 · 732 in bank

   A company has used AWS Lambda functions to build an application on AWS. The company’s security engineer implemented Amazon Inspector and activated Lambda standard scanning and Lambda code scanning. The security engineer reviews the Amazon Inspector console and learns that Amazon Inspector is not scanning some of the Lambda functions. The provided reason is that the scan eligibility expired. What should the security engineer do to investigate the reason that the scans are failing?

   • AValidate that the AmazonInspector2ServiceRolePolicy AWS managed policy grants permissions to access Lambda.
   • BIncrease the timeout value of the Lambda functions to complete the scans successfully while the code is running.
   • CBuild a custom runtime for the unscanned Lambda functions. Include the Amazon Inspector agent in the runtime.
   • DDetermine whether the unscanned Lambda functions have been invoked in the last 90 days.

   Show answer

   Answer: D

   Explanation

   To investigate the reason that some Lambda functions are not being scanned due to scan eligibility expiring, the security engineer should: D. Determine whether the unscanned Lambda functions have been invoked in the last 90 days. Amazon Inspector's eligibility for scanning Lambda functions is typically based on activity. If a Lambda function has not been invoked in the last 90 days, it may no longer be eligible for scanning. This helps ensure that only active and potentially vulnerable functions are scanned, optimizing resource usage and focusing on functions that are in use.

   Source: Adapted from community discussion — IPLogic

   References

   • AWS documentation

   Next question

6. Question 306 · 732 in bank

   A company manages three separate AWS accounts for its production, development, and test environments. Each Developer is assigned a unique IAM user under the development account. A new application hosted on an Amazon EC2 instance in the development account requires read access to the archived documents stored in an Amazon S3 bucket in the production account. How should access be granted?

   • ACreate an IAM role in the production account and allow EC2 instance in the development account to assume that role using the trust policy. Provide read access for the required S3 bucket to this role.
   • BUse a custom identity broker to allow Developer IAM users to temporarily access the S3 bucket.
   • CCreate a temporary IAM user for the application to use in the production account.
   • DCreate a temporary IAM user in the production account and provide read access to Amazon S3. Generate the temporary IAM user's access key and secret key and store these keys on the EC2 instance used by the application in the development account.

   Show answer

   Answer: A

   Next question

7. Question 307 · 732 in bank

   A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon EC2 instance that hosts the company’s primary website. The GuardDuty finding received read: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The security engineer confirmed that a malicious actor used API access keys intended for the EC2 instance from a country where the company does not operate. The security engineer needs to deny access to the malicious actor. What is the first step the security engineer should take?

   • AOpen the EC2 console and remove any security groups that allow inbound traffic from 0.0.0.0/0.
   • BInstall the AWS Systems Manager Agent on the EC2 instance and run an inventory report.
   • CInstall the Amazon Inspector agent on the host and run an assessment with the CVE rules package.
   • DOpen the IAM console and revoke all IAM sessions that are associated with the instance profile.

   Show answer

   Answer: D

   Next question

8. Question 308 · 732 in bank

   A company requires that SSH commands used to access its AWS instance be traceable to the user who executed each command. How should a Security Engineer accomplish this?

   • AAllow inbound access on port 22 at the security group attached to the instance. Use AWS Systems Manager Session Manager for shell access to Amazon EC2 instances with the user tag defined. Enable Amazon CloudWatch logging for Systems Manager sessions.
   • BUse Amazon S3 to securely store one Privacy Enhanced Mail Certificate (PEM file) for each user. Allow Amazon EC2 to read from Amazon S3 and import every user that wants to use SSH to access EC2 instances. Allow inbound access on port 22 at the security group attached to the instance. Install the Amazon CloudWatch agent on the EC2 instance and configure it to ingest audit logs for the instance.
   • CDeny inbound access on port 22 at the security group attached to the instance. Use AWS Systems Manager Session Manager for shell access to Amazon EC2 instances with the user tag defined. Enable Amazon CloudWatch logging for Systems Manager sessions.
   • DUse Amazon S3 to securely store one Privacy Enhanced Mail Certificate (PEM file) for each team or group. Allow Amazon EC2 to read from Amazon S3 and import every user that wants to use SSH to access EC2 instance. Allow inbound access on port 22 at the security group attached to the instance. Install the Amazon CloudWatch agent on the EC2 instance and configure it to ingest audit logs for the instances.

   Show answer

   Answer: C

   Next question

9. Question 309 · 732 in bank

   A company is testing incident response procedures for destination containment. The company needs to contain a critical Amazon EC2 instance as quickly as possible while keeping the EC2 instance running. The EC2 instance is the only resource in a public subnet and has active connections to other resources. Which solution will contain the EC2 instance IMMEDIATELY?

   • ACreate a new security group that has no inbound rules or outbound rules. Attach the new security group to the EC2 instance.
   • BConfigure the existing security group for the EC2 instance. Remove all existing inbound rules and outbound rules from the security group.
   • CCreate a new network ACL that has a single Deny rule for inbound traffic and outbound traffic. Associate the new network ACL with the subnet that contains the EC2 instance.
   • DCreate a new VPC for isolation. Stop the EC2 instance. Create a new AMI from the EC2 instance. Use the new AMI to launch a new EC2 instance in the new VPC.

   Show answer

   Answer: C

   Explanation

   Given that there are no other resources in the subnet apart from the EC2 instance, the most immediate and effective way to contain the instance while keeping it running is: C. Create a new network ACL that has a single Deny rule for inbound traffic and outbound traffic. Associate the new network ACL with the subnet that contains the EC2 instance. This approach will instantly isolate the EC2 instance from the network by denying all inbound and outbound traffic at the subnet level, ensuring no accidental connections can be made.

   Source: Adapted from community discussion — IPLogic

   Next question

10. Question 310 · 732 in bank

    An organizational must establish the ability to delete an AWS KMS Customer Master Key (CMK) within a 24-hour timeframe to keep it from being used for encrypt or decrypt operations. Which of the following actions will address this requirement?

    • AManually rotate a key within KMS to create a new CMK immediately.
    • BUse the KMS import key functionality to execute a delete key operation.
    • CUse the schedule key deletion function within KMS to specify the minimum wait period for deletion.
    • DChange the KMS CMK alias to immediately prevent any services from using the CMK.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 301. 732 questions available.