SCS-C02 practice questions 341–350

1. Question 341 · 732 in bank

   A company needs to retain data that is stored in Amazon CloudWatch Logs log groups. The company must retain this data for 90 days. The company must receive notification in AWS Security Hub when log group retention is not compliant with this requirement. Which solution will provide the appropriate notification?

   • ACreate a Security Hub custom action to assess the log group retention period.
   • BCreate a data protection policy in CloudWatch Logs to assess the log group retention period.
   • CCreate a Security Hub automation rule. Configure the automation rule to assess the log group retention period.
   • DUse the AWS Config managed rule that assesses the log group retention period. Ensure that AWS Config integration is enabled in Security Hub.

   Show answer

   Answer: D

   Explanation

   AWS Config Managed Rule: AWS Config provides a managed rule specifically for assessing the retention period of CloudWatch Logs log groups. This rule will automatically evaluate whether log groups comply with the specified retention period (in this case, 90 days). Integration with Security Hub: By enabling AWS Config integration with Security Hub, non-compliant configurations identified by AWS Config can trigger notifications in Security Hub. This ensures that any deviations from the retention policy are promptly reported.

   Source: Adapted from community discussion — IPLogic

   Next question

2. Question 342 · 732 in bank

   A company has hundreds of AWS accounts, and a centralized Amazon S3 bucket used to collect AWS CloudTrail logs for all of these accounts. A Security Engineer wants to create a solution that will enable the company to run ad hoc queries against its CloudTrail logs dating back 3 years from when the trails were first enabled in the company's AWS account. How should the company accomplish this with the least amount of administrative overhead?

   • ARun an Amazon EMR cluster that uses a MapReduce job to examine the CloudTrail trails.
   • BUse the events history feature of the CloudTrail console to query the CloudTrail trails.
   • CWrite an AWS Lambda function to query the CloudTrail trails. Configure the Lambda function to be executed whenever a new file is created in the CloudTrail S3 bucket.
   • DCreate an Amazon Athena table that looks at the S3 bucket the CloudTrail trails are being written to. Use Athena to run queries against the trails.

   Show answer

   Answer: D

   Next question

3. Question 343 · 732 in bank

   A company needs to prevent Amazon S3 objects from being shared with IAM identities outside of the company’s organization in AWS Organizations. A security engineer is creating and deploying an SCP to accomplish this goal. The company has enabled the S3 Block Public Access feature on all of its S3 buckets. What should the SCP do to meet these requirements?

   • ADeny the S3:* action with a Condition element that comprises an operator of StringNotEquals, a key of aws:ResourceOrgID, and a value of S{aws PrincipalOrgID}.
   • BDeny the S3:PutAccountPublicAccessBlock action with a Condition element that comprises an operator of StringLike, a key of aws:PrincipalArn, and the values of the external IAM principals.
   • CAllow the S3:* action with a Condition element that comprises an operator of StringNotEquals, a key of aws:PrincipalOrgID, and a value of S{aws:PrincipalOrgID}.
   • DDeny the S3:* action with a Condition element that comprises an operator of StringLike, a key of aws:PrincipalArn, and the values of the external IAM principals

   Show answer

   Answer: A

   Next question

4. Question 344 · 732 in bank

   A Security Engineer is troubleshooting a connectivity issue between a web server that is writing log files to the logging server in another VPC. The Engineer has confirmed that a peering relationship exists between the two VPCs. VPC flow logs show that requests sent from the web server are accepted by the logging server, but the web server never receives a reply. Which of the following actions could fix this issue?

   • AAdd an inbound rule to the security group associated with the logging server that allows requests from the web server.
   • BAdd an outbound rule to the security group associated with the web server that allows requests to the logging server.
   • CAdd a route to the route table associated with the subnet that hosts the logging server that targets the peering connection.
   • DAdd a route to the route table associated with the subnet that hosts the web server that targets the peering connection.

   Show answer

   Answer: C

   Next question

5. Question 345 · 732 in bank

   A security engineer is implementing authentication for a multi-account environment by using federated access with SAML 2.0. The security engineer has configured AWS IAM Identity Center as an identity provider (IdP). The security engineer also has created IAM roles to grant access to the AWS accounts. A federated user reports an authentication failure when the user attempts to authenticate with the new system. What should the security engineer do to troubleshoot this issue in the MOST operationally efficient way?

   • AReview the SAML IdP logs to identify errors. Check AWS CloudTrail to verify the API calls that the user made.
   • BReview the SAML IdP logs to identify errors. Use the IAM policy simulator to validate access to the IAM roles.
   • CUse IAM access advisor to review recent service access. Use the IAM policy simulator to validate access to the IAM roles.
   • DRecreate the SAML IdP in a separate account to confirm the behavior that the user is experiencing.

   Show answer

   Answer: A

   Next question

6. Question 346 · 732 in bank

   A Security Engineer accidentally deleted the imported key material in an AWS KMS CMK. What should the Security Engineer do to restore the deleted key material?

   • ACreate a new CMK. Download a new wrapping key and a new import token to import the original key material.
   • BCreate a new CMK. Use the original wrapping key and import token to import the original key material.
   • CDownload a new wrapping key and a new import token. Import the original key material into the existing CMK.
   • DUse the original wrapping key and import token. Import the original key material into the existing CMK.

   Show answer

   Answer: C

   Next question

7. Question 347 · 732 in bank

   A company stores sensitive data in an Amazon S3 bucket. The company encrypts the data at rest by using server-side encryption with Amazon S3 managed keys (SSE-S3). A security engineer must prevent any modifications to the data in the S3 bucket. Which solution will meet this requirement?

   • AConfigure S3 bucket policies to deny DELETE and PUT object permissions.
   • BConfigure S3 Object Lock in compliance mode with S3 bucket versioning enabled.
   • CChange the encryption on the S3 bucket to use AWS Key Management Service (AWS KMS) customer managed keys.
   • DConfigure the S3 bucket with multi-factor authentication (MFA) delete protection.

   Show answer

   Answer: B

   Next question

8. Question 348 · 732 in bank

   A company's Security Engineer is copying all application logs to centralized Amazon S3 buckets. Currently, each of the company's application is in its own AWS account, and logs are pushed into S3 buckets associated with each account. The Engineer will deploy an AWS Lambda function into each account that copies the relevant log files to the centralized S3 bucket. The Security Engineer is unable to access the log files in the centralized S3 bucket. The Engineer's IAM user policy from the centralized account looks like this:

   

   The centralized S3 bucket policy looks like this:

   

   Why is the Security Engineer unable to access the log files?

   • AThe S3 bucket policy does not explicitly allow the Security Engineer access to the objects in the bucket.
   • BThe object ACLs are not being updated to allow the users within the centralized account to access the objects.
   • CThe Security Engineer's IAM policy does not grant permissions to read objects in the S3 bucket.
   • DThe s3:PutObject and s3:PutObjectAcl permissions should be applied at the S3 bucket level.

   Show answer

   Answer: B

   Next question

9. Question 349 · 732 in bank

   Select 2

   A company is developing a new serverless application that uses AWS Lambda functions. The company uses AWS CloudFormation to deploy the Lambda functions. The company’s developers are trying to debug a Lambda function that is deployed. The developers cannot debug the Lambda function because the Lambda function is not logging its output to Amazon CloudWatch Logs. Which combination of steps should a security engineer take to resolve this issue? (Choose two.)

   • ACheck the role that is defined in the CloudFormation template and is passed to the Lambda function. Ensure that the role has a trust policy that allows the sts:AssumeRole action by the service principal lambda amazonaws.com.
   • BCheck the execution role that is configured in the CloudFormation template for the Lambda function. Ensure that the execution role has the necessary permissions to write to CloudWatch Logs.
   • CCheck the Lambda function configuration in the CloudFormation template. Ensure that the Lambda function has an AWS X-Ray tracing configuration that is set to Active mode or PassThrough mode.
   • DCheck the resource policy that is configured in the CloudFormation template for the Lambda function. Ensure that the resource policy has the necessary permissions to write to CloudWatch Logs.
   • ECheck the role that the developers use to debug the Lambda function. Ensure that the role has a trust policy that allows the sts:AssumeRole action by the service principal lambda.amazonaws.com.

   Show answer

   Answer: AB

   Next question

10. Question 350 · 732 in bank

    An application running on Amazon EC2 instances generates log files in a folder on a Linux file system. The instances block access to the console and file transfer utilities, such as Secure Copy Protocol (SCP) and Secure File Transfer Protocol (SFTP). The Application Support team wants to automatically monitor the application log files so the team can set up notifications in the future. A Security Engineer must design a solution that meets the following requirements: ✑ Make the log files available through an AWS managed service. Allow for automatic monitoring of the logs.

    

    ✑ Provide an interface for analyzing logs. ✑ Minimize effort. Which approach meets these requirements?

    • AModify the application to use the AWS SDK. Write the application logs to an Amazon S3 bucket.
    • BInstall the unified Amazon CloudWatch agent on the instances. Configure the agent to collect the application log files on the EC2 file system and send them to Amazon CloudWatch Logs.
    • CInstall AWS Systems Manager Agent on the instances. Configure an automation document to copy the application log files to AWS DeepLens.
    • DInstall Amazon Kinesis Agent on the instances. Stream the application log files to Amazon Kinesis Data Firehose and set the destination to Amazon Elasticsearch Service.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 341. 732 questions available.