SCS-C02 practice questions 361–370

1. Question 361 · 732 in bank

   Select 3

   A company's Chief Security Officer has requested that a Security Analyst review and improve the security posture of each company AWS account. The Security Analyst decides to do this by improving AWS account root user security. Which actions should the Security Analyst take to meet these requirements? (Choose three.)

   • ADelete the access keys for the account root user in every account.
   • BCreate an admin IAM user with administrative privileges and delete the account root user in every account.
   • CImplement a strong password to help protect account-level access to the AWS Management Console by the account root user.
   • DEnable multi-factor authentication (MFA) on every account root user in all accounts.
   • ECreate a custom IAM policy to limit permissions to required actions for the account root user and attach the policy to the account root user.
   • FAttach an IAM role to the account root user to make use of the automated credential rotation in AWS STS.

   Show answer

   Answer: ACD

   Next question

2. Question 362 · 732 in bank

   A company uses Amazon Elastic Kubernetes Service (Amazon EKS) clusters to run its Kubernetes-based applications. The company uses Amazon GuardDuty to protect the applications. EKS Protection is enabled in GuardDuty. However, the corresponding GuardDuty feature is not monitoring the Kubernetes-based applications. Which solution will cause GuardDuty to monitor the Kubernetes-based applications?

   • AEnable VPC flow logs for the VPC that hosts the EKS clusters.
   • BAssign the CloudWatchEventsFullAccess AWS managed policy to the EKS clusters.
   • CEnsure that the AmazonGuardDutyFullAccess AWS managed policy is attached to the GuardDuty service role.
   • DEnable the control plane logs in Amazon EKS. Ensure that the logs are ingested into Amazon CloudWatch.

   Show answer

   Answer: D

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 363 · 732 in bank

   A large company wants its Compliance team to audit its Amazon S3 buckets to identify if personally identifiable information (PII) is stored in them. The company has hundreds of S3 buckets and has asked the Security Engineers to scan every bucket. How can this task be accomplished?

   • AConfigure Amazon CloudWatch Events to trigger Amazon Inspector to scan the S3 buckets daily for PII. Configure Amazon Inspector to publish Amazon SNS notifications to the Compliance team if PII is detected.
   • BConfigure Amazon Macie to classify data in the S3 buckets and check the dashboard for PII findings. Configure Amazon CloudWatch Events to capture Macie alerts and target an Amazon SNS topic to be notified if PII is detected.
   • CCheck the AWS Trusted Advisor data loss prevention page in the AWS Management Console. Download the Amazon S3 data confidentiality report and send it to the Compliance team. Configure Amazon CloudWatch Events to capture Trusted Advisor alerts and target an Amazon SNS topic to be notified if PII is detected.
   • DEnable Amazon GuardDuty in multiple Regions to scan the S3 buckets. Configure Amazon CloudWatch Events to capture GuardDuty alerts and target an Amazon SNS topic to be notified if PII is detected.

   Show answer

   Answer: B

   Next question

4. Question 364 · 732 in bank

   A company needs to log object-level activity in its Amazon S3 buckets. The company also needs to validate the integrity of the log file by using a digital signature. Which solution will meet these requirements?

   • ACreate an AWS CloudTrail trail with log file validation enabled. Enable data events. Specify Amazon S3 as the data event type.
   • BCreate a new S3 bucket for S3 server access logs. Configure the existing S3 buckets to send their S3 server access logs to the new S3 bucket.
   • CCreate an Amazon CloudWatch Logs log group. Configure the existing S3 buckets to send their S3 server access logs to the log group.
   • DCreate a new S3 bucket for S3 server access logs with log file validation enabled. Enable data events. Specify Amazon S3 as the data event type.

   Show answer

   Answer: A

   Explanation

   Object-Level Logging: By enabling data events in AWS CloudTrail and specifying Amazon S3 as the data event type, you can log object-level activities such as GET, PUT, DELETE, and other operations on your S3 objects. Log File Validation: AWS CloudTrail provides the option to enable log file integrity validation. When this feature is enabled, CloudTrail creates a hash for each log file and delivers it alongside the log file. This ensures that you can verify the integrity and authenticity of your log files, confirming they haven't been tampered with.

   Source: Adapted from community discussion — IPLogic

   Next question

5. Question 365 · 732 in bank

   During a manual review of system logs from an Amazon Linux EC2 instance, a Security Engineer noticed that there are sudo commands that were never properly alerted or reported on the Amazon CloudWatch Logs agent. Why were there no alerts on the sudo commands?

   • AThere is a security group blocking outbound port 80 traffic that is preventing the agent from sending the logs.
   • BThe IAM instance profile on the EC2 instance was not properly configured to allow the CloudWatch Logs agent to push the logs to CloudWatch.
   • CCloudWatch Logs status is set to ON versus SECURE, which prevents if from pulling in OS security event logs.
   • DThe VPC requires that all traffic go through a proxy, and the CloudWatch Logs agent does not support a proxy configuration.

   Show answer

   Answer: B

   Next question

6. Question 366 · 732 in bank

   Select 2

   A company has a new web-based account management system for an online game. Players create a unique username and password to log in to the system. The company has implemented an AWS WAF web ACL for the system. The web ACL includes the core rule set (CRS) AWS managed rule group on the Application Load Balancer that serves the system. The company’s security team finds that the system was the target of a credential stuffing attack. Credentials that were exposed in other breaches were used to try to log in to the system. The security team must implement a solution to reduce the chance of a successful credential stuffing attack in the future. The solution also must minimize impact on legitimate users of the system. Which combination of actions will meet these requirements? (Choose two.)

   • ACreate an Amazon CloudWatch custom metric to analyze the number of successful login responses from a single IP address.
   • BAdd the account takeover prevention (ATP) AWS managed rule group to the web ACL. Configure the rule group to inspect login requests to the system. Block any requests that have the awswaf:managed:aws:atp:signal:credential_compromised label.
   • CConfigure a default web ACL action that requires all users to solve a CAPTCHA puzzle when they log in.
   • DImplement IP-based match rules in the web ACL for any IP addresses that generate many successful login responses. Block any IP addresses that generate many successful logins.
   • ECreate a custom block response that redirects users to a secure workflow to reset their password inside the system.

   Show answer

   Answer: AB

   Explanation

   Explanation: By monitoring and analyzing successful login attempts from individual IP addresses, you can detect patterns that suggest credential stuffing. This allows you to take targeted actions against suspicious IPs, improving security without impacting legitimate users. B. Add the account takeover prevention (ATP) AWS managed rule group to the web ACL. Configure the rule group to inspect login requests to the system. Block any requests that have the awswaf:managed:aws:atp:signal:credential_compromised label. Explanation: This managed rule group specifically targets account takeover attempts, including credential stuffing. By automatically inspecting and blocking compromised login requests, you add a critical layer of defense without disrupting legitimate user access.

   Source: Adapted from community discussion — IPLogic

   References

   • AWS documentation

   Next question

7. Question 367 · 732 in bank

   A company has an AWS account and allows a third-party contractor, who uses another AWS account, to assume certain IAM roles. The company wants to ensure that IAM roles can be assumed by the contractor only if the contractor has multi-factor authentication enabled on their IAM user accounts. What should the company do to accomplish this?

   • AAdd the following condition to the IAM policy attached to all IAM roles: "Effect": "Deny", "Condition" : { "BoolItExists" : { "aws:MultiFactorAuthPresent" : false } }
   • BAdd the following condition to the IAM policy attached to all IAM roles: "Effect": "Deny", "Condition" : { "Bool" : { "aws:MultiFactorAuthPresent" : false } }
   • CAdd the following condition to the IAM policy attached to all IAM roles: "Effect": "Allow", "Condition" : { "Null" : { "aws:MultiFactorAuthPresent" : false } }
   • DAdd the following condition to the IAM policy attached to all IAM roles: "Effect": "Allow", "Condition" : { "BoolItExists" : { "aws:MultiFactorAuthPresent" : false } }

   Show answer

   Answer: A

   Next question

8. Question 368 · 732 in bank

   A company runs workloads on Amazon EC2 instances. The company needs to continually monitor the EC2 instances for software vulnerabilities and must display the findings in AWS Security Hub. The company must not install agents on the EC2 instances. Which solution will meet these requirements?

   • AEnable Amazon Inspector. Set the scan mode to hybrid scanning. Enable the integration for Amazon Inspector in Security Hub.
   • BUse Security Hub to enable the AWS Foundational Security Best Practices standard. Wait for Security Hub to generate the findings.
   • CEnable Amazon GuardDuty. Initiate on-demand malware scans by using GuardDuty Malware Protection. Enable the integration for GuardDuty in Security Hub.
   • DUse AWS Config managed rules to detect EC2 software vulnerabilities. Ensure that Security Hub has the AWS Config integration enabled.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

9. Question 369 · 732 in bank

   A large corporation is creating a multi-account strategy and needs to determine how its employees should access the AWS Infrastructure. Which of the following solutions would provide the MOST scalable solution?

   • ACreate dedicated IAM users within each AWS account that employees can assume though federation based upon group membership in their existing identity provider.
   • BUse a centralized account with IAM roles that employees can assume through federation with their existing identity provider. Use cross-account roles to allow the federated users to assume their target role in the resource accounts.
   • CConfigure the AWS Security Token Service to use Kerberos tokens so that users can use their existing corporate user names and passwords to access AWS resources directly.
   • DConfigure the IAM trust policies within each account's role to set up a trust back to the corporation's existing identity provider, allowing users to assume the role based off their SAML token.

   Show answer

   Answer: B

   Next question

10. Question 370 · 732 in bank

    A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that store. Each store's application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS account. The company uses AWS Organizations and has an OU that is used only for these accounts. The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company's deployment plan for AWS resources. The security engineer also must limit access to the deployment plan to only the developers who need access. The security engineer already has created an AWS CloudFormation template that implements the deployment plan. What should the security engineer do next to meet the requirements in the MOST secure way?

    • ACreate an AWS Service Catalog portfolio in the organization's management account. Upload the CloudFormation template. Add the template to the portfolio's product list. Share the portfolio with the OU.
    • BUse the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. In the OU, create an SCP that allows access to the extension.
    • CCreate an AWS Service Catalog portfolio in the organization's management account. Upload the CloudFormation template. Add the template to the portfolio's product list. Create an IAM role that has a trust policy that allows cross-account access to the portfolio for users in the OU accounts. Attach the AWSServiceCatalogEndUserFullAccess managed policy to the role.
    • DUse the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. Share the extension with the OU.

    Show answer

    Answer: A

    Explanation

    To use Service Catalog with multiple AWS accounts, you need to enable AWS Organizations with all features enabled. This allows you to centrally manage your accounts and apply policies across your organization. You can also use Service Catalog as a service principal for AWS Organizations, which lets you share your portfolios with organizational units (OUs) or accounts in your organization. To create a Service Catalog portfolio, you need to use an administrator account, such as the organization's management account. You can upload your CloudFormation template as a product in your portfolio, and define constraints and tags for it. You can then share your portfolio with the OU that contains the accounts for the web applications. This will allow the developers in those accounts to launch products from the shared portfolio using the Service Catalog end user console.

    Source: Adapted from community discussion — Christina666

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 361. 732 questions available.