SCS-C02 practice questions 31–40

1. Question 31 · 732 in bank

   A company is testing its incident response plan for compromised credentials. The company runs a database on an Amazon EC2 instance and stores the sensitive database credentials as a secret in AWS Secrets Manager. The secret has rotation configured with an AWS Lambda function that uses the generic rotation function template. The EC2 instance and the Lambda function are deployed in the same private subnet. The VPC has a Secrets Manager VPC endpoint. A security engineer discovers that the secret cannot rotate. The security engineer determines that the VPC endpoint is working as intended. The Amazon CloudWatch logs contain the following error: "setSecret: Unable to log into database". Which solution will resolve this error?

   • AUse the AWS Management Console to edit the JSON structure of the secret in Secrets Manager so that the secret automatically conforms with the structure that the database requires.
   • BEnsure that the security group that is attached to the Lambda function allows outbound connections to the EC2 instance. Ensure that the security group that is attached to the EC2 instance allows inbound connections from the security group that is attached to the Lambda function.
   • CUse the Secrets Manager list-secrets command in the AWS CLI to list the secret. Identify the database credentials. Use the Secrets Manager rotate-secret command in the AWS CLI to force the immediate rotation of the secret.
   • DAdd an internet gateway to the VPC. Create a NAT gateway in a public subnet. Update the VPC route tables so that traffic from the Lambda function and traffic from the EC2 instance can reach the Secrets Manager public endpoint.

   Show answer

   Answer: B

   Explanation

   Hate questions like these which rather then testing your knoweledge of technologies trick you into these weired worded questions. the statement 'Ensure that the security group that is attached to the Lambda function allows outbound' threw me off as Lambda does not have SGs. But then through some internet digging came accross the fact that when a Lambda function needs to access resources inside a Virtual Private Cloud (VPC), it does so using ENI which resides in a subnet of the VPC and can have a security group associated with it. The security group acts as a virtual firewall for the ENI.

   Source: Adapted from community discussion — yorkicurke

   Next question

2. Question 32 · 732 in bank

   Select 2

   An IAM user with fill EC2 permissions could bot start an Amazon EC2 instance after it was stopped for a maintenance task. Upon starting the instance, the instance state would change to `Pending`, but after a few seconds, it would switch back to `Stopped`. An inspection revealed that the instance has attached Amazon EBS volumes that were encrypted by using a Customer Master Key (CMK). When these encrypted volumes were detached, the IAM user was able to start the EC2 instances. The IAM user policy is as follows:

   

   What additional items need to be added to the IAM user policy? (Choose two.)

   • Akms:GenerateDataKey
   • Bkms:Decrypt
   • Ckms:CreateGrant
   • Dג€Conditionג€: { ג€Boolג€: { ג€kms:ViaServiceג€: ג€ec2.us-west-2.amazonaws.comג€ } }
   • Eג€Conditionג€: { ג€Boolג€: { ג€kms:GrantIsForAWSResourceג€: true } }

   Show answer

   Answer: CE

   Next question

3. Question 33 · 732 in bank

   Select 2

   A Security Administrator has a website hosted in Amazon S3. The Administrator has been given the following requirements: ✑ Users may access the website by using an Amazon CloudFront distribution. ✑ Users may not access the website directly by using an Amazon S3 URL. Which configurations will support these requirements? (Choose two.)

   • AAssociate an origin access identity with the CloudFront distribution.
   • BImplement a ג€Principalג€: ג€cloudfront.amazonaws.comג€ condition in the S3 bucket policy.
   • CModify the S3 bucket permissions so that only the origin access identity can access the bucket contents.
   • DImplement security groups so that the S3 bucket can be accessed only by using the intended CloudFront distribution.
   • EConfigure the S3 bucket policy so that it is accessible only through VPC endpoints, and place the CloudFront distribution into the specified VPC.

   Show answer

   Answer: AC

   Next question

4. Question 34 · 732 in bank

   A company needs to follow security best practices to deploy resources from an AWS CloudFormation template. The CloudFormation template must be able to configure sensitive database credentials. The company already uses AWS Key Management Service (AWS KMS) and AWS Secrets Manager. Which solution will meet the requirements?

   • AUse a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.
   • BUse a parameter in the CloudFormation template to reference the database credentials. Encrypt the CloudFormation template by using AWS KMS.
   • CUse a SecureString parameter in the CloudFormation template to reference the database credentials in Secrets Manager.
   • DUse a SecureString parameter in the CloudFormation template to reference an encrypted value in AWS KMS.

   Show answer

   Answer: A

   Explanation

   Since this is the last question here so maybe I can post it here. I've passed this exam with a score of 926. Only few of the questions were not from this exam material but else, everything came from here. Would like to thanks to all of you who helped in answering my queries and got my concept clarified!... Man_Kind, Agboola and others, you guys simply rock, thanks once again so much! :)

   Source: Adapted from community discussion — Aamee

   References

   • AWS documentation

   Next question

5. Question 35 · 732 in bank

   A Security Engineer has created an Amazon CloudWatch event that invokes an AWS Lambda function daily. The Lambda function runs an Amazon Athena query that checks AWS CloudTrail logs in Amazon S3 to detect whether any IAM user accounts or credentials have been created in the past 30 days. The results of the Athena query are created in the same S3 bucket. The Engineer runs a test execution of the Lambda function via the AWS Console, and the function runs successfully. After several minutes, the Engineer finds that his Athena query has failed with the error message: `Insufficient Permissions`. The IAM permissions of the Security Engineer and the Lambda function are shown below: Security Engineer -

   

   Lambda function execution role -

   

   What is causing the error?

   • AThe Lambda function does not have permissions to start the Athena query execution.
   • BThe Security Engineer does not have permissions to start the Athena query execution.
   • CThe Athena service does not support invocation through Lambda.
   • DThe Lambda function does not have permissions to access the CloudTrail S3 bucket.

   Show answer

   Answer: D

   Next question

6. Question 36 · 732 in bank

   Select 3

   An international company wants to combine AWS Security Hub findings across all the company's AWS Regions and from multiple accounts. In addition, the company wants to create a centralized custom dashboard to correlate these findings with operational data for deeper analysis and insights. The company needs an analytics tool to search and visualize Security Hub findings. Which combination of steps will meet these requirements? (Chose three.)

   • ADesignate an AWS account as a delegated administrator for Security Hub. Publish events to Amazon CloudWatch from the delegated administrator account, all member accounts, and required Regions that are enabled for Security Hub findings.
   • BDesignate an AWS account in an organization in AWS Organizations as a delegated administrator for Security Hub. Publish events to Amazon EventBridge from the delegated administrator account, all member accounts, and required Regions that are enabled for Security Hub findings.
   • CIn each Region, create an Amazon EventBridge rule to deliver findings to an Amazon Kinesis data stream. Configure the Kinesis data streams to output the logs to a single Amazon S3 bucket.
   • DIn each Region, create an Amazon EventBridge rule to deliver findings to an Amazon Kinesis Data Firehose delivery stream. Configure the Kinesis Data Firehose delivery streams to deliver the logs to a single Amazon S3 bucket.
   • EUse AWS Glue DataBrew to crawl the Amazon S3 bucket and build the schema. Use AWS Glue Data Catalog to query the data and create views to flatten nested attributes. Build Amazon QuickSight dashboards by using Amazon Athena.
   • FPartition the Amazon S3 data. Use AWS Glue to crawl the S3 bucket and build the schema. Use Amazon Athena to query the data and create views to flatten nested attributes. Build Amazon QuickSight dashboards that use the Athena views.

   Show answer

   Answer: BDF

   Explanation

   Not A, do not need cloud watch. Not C, Kinesis Data firehose(Now Amazon Data Firehose) is what we need here, not Kinesis Data Streams. Not E . Rather use Athena to query S3 See Ref https://aws.amazon.com/blogs/architecture/visualize-aws-security-hub-findings-using-analytics-and-business-intelligence-tools/

   Source: Adapted from community discussion — ion_gee

   References

   • AWS documentation

   Next question

7. Question 37 · 732 in bank

   Select 2

   A company requires that IP packet data be inspected for invalid or malicious content. Which of the following approaches achieve this requirement? (Choose two.)

   • AConfigure a proxy solution on Amazon EC2 and route all outbound VPC traffic through it. Perform inspection within proxy software on the EC2 instance.
   • BConfigure the host-based agent on each EC2 instance within the VPC. Perform inspection within the host-based agent.
   • CEnable VPC Flow Logs for all subnets in the VPC. Perform inspection from the Flow Log data within Amazon CloudWatch Logs.
   • DConfigure Elastic Load Balancing (ELB) access logs. Perform inspection from the log data within the ELB access log files.
   • EConfigure the CloudWatch Logs agent on each EC2 instance within the VPC. Perform inspection from the log data within CloudWatch Logs.

   Show answer

   Answer: AB

   Next question

8. Question 38 · 732 in bank

   An AWS account administrator created an IAM group and applied the following managed policy to require that each individual user authenticate using multi-factor authentication:

   

   After implementing the policy, the administrator receives reports that users are unable to perform Amazon EC2 commands using the AWS CLI. What should the administrator do to resolve this problem while still enforcing multi-factor authentication?

   • AChange the value of aws:MultiFactorAuthPresent to true.
   • BInstruct users to run the aws sts get-session-token CLI command and pass the multi-factor authentication --serial-number and -token-code parameters. Use these resulting values to make API/CLI calls.
   • CImplement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.
   • DCreate a role and enforce multi-factor authentication in the role trust policy. Instruct users to run the sts assume-role CLI command and pass --serial-number and --token-code parameters. Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.

   Show answer

   Answer: B

   Next question

9. Question 39 · 732 in bank

   An organization has a system in AWS that allows a large number of remote workers to submit data files. File sizes vary from a few kilobytes to several megabytes. A recent audit highlighted a concern that data files are not encrypted while in transit over untrusted networks. Which solution would remediate the audit finding while minimizing the effort required?

   • AUpload an SSL certificate to IAM, and configure Amazon CloudFront with the passphrase for the private key.
   • BCall KMS.Encrypt() in the client, passing in the data file contents, and call KMS.Decrypt() server-side.
   • CUse AWS Certificate Manager to provision a certificate on an Elastic Load Balancing in front of the web service's servers.
   • DCreate a new VPC with an Amazon VPC VPN endpoint, and update the web service's DNS record.

   Show answer

   Answer: C

   Next question

10. Question 40 · 732 in bank

    A company is developing a mechanism that will help data scientists use Amazon SageMaker to read, process, and output data to an Amazon S3 bucket. Data scientists will have access to a dedicated S3 prefix for each of their projects. The company will implement bucket policies that use the dedicated S3 prefixes to restrict access to the S3 objects. The projects can last up to 60 days. The company's security team mandates that data cannot remain in the S3 bucket after the end of the projects that use the data. Which solution will meet these requirements MOST cost-effectively?

    • ACreate an AWS Lambda function to identify and delete objects in the S3 bucket that have not been accessed for 60 days. Create an Amazon EventBridge scheduled rule that runs every day to invoke the Lambda function.
    • BCreate a new S3 bucket. Configure the new S3 bucket to use S3 Intelligent-Tiering. Copy the objects to the new S3 bucket.
    • CCreate an S3 Lifecycle configuration for each S3 bucket prefix for each project. Set the S3 Lifecycle configurations to expire objects after 60 days.
    • DCreate an AWS Lambda function to delete objects that have not been accessed for 60 days. Create an S3 event notification for S3 Intelligent-Tiering automatic archival events to invoke the Lambda function.

    Show answer

    Answer: C

    Explanation

    anyone given exam in this week or last week can anyone confirm is this question is good for practise or required more question ?

    Source: Adapted from community discussion — rishikeshshukla7777

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 31. 732 questions available.