SCS-C02 practice questions 441–450

1. Question 441 · 732 in bank

   A company discovers a billing anomaly in its AWS account. A security consultant investigates the anomaly and discovers that an employee who left the company 30 days ago still has access to the account. The company has not monitored account activity in the past. The security consultant needs to determine which resources have been deployed or reconfigured by the employee as quickly as possible. Which solution will meet these requirements?

   • AIn AWS Cost Explorer, filter chart data to display results from the past 30 days. Export the results to a data table. Group the data table by resource.
   • BUse AWS Cost Anomaly Detection to create a cost monitor. Access the detection history. Set the time frame to Last 30 days. In the search area, choose the service category.
   • CIn AWS CloudTrail, filter the event history to display results from the past 30 days. Create an Amazon Athena table that contains the data. Partition the table by event source.
   • DUse AWS Audit Manager to create an assessment for the past 30 days. Apply a usage-based framework to the assessment. Configure the assessment to assess by resource.

   Show answer

   Answer: C

   Explanation

   Answer C. CloudTrail for as quickly as possible. Look up events related to the creation, modification, or deletion of resources in your AWS account. AWS Cost Anomaly Detection: For a new service subscription, 10 days of historical service usage data is needed before anomalies can be detected for that service. If you create a new monitor, it can take up to 24 hours to begin detecting new anomalies.

   Source: Adapted from community discussion — 100fold

   References

   • AWS documentation

   Next question

2. Question 442 · 732 in bank

   Select 2

   A company is migrating one of its legacy systems from an on-premises data center to AWS. The application server will run on AWS, but the database must remain in the on-premises data center for compliance reasons. The database is sensitive to network latency. Additionally, the data that travels between the on-premises data center and AWS must have IPsec encryption. Which combination of AWS solutions will meet these requirements? (Choose two.)

   • AAWS Site-to-Site VPN
   • BAWS Direct Connect
   • CAWS VPN CloudHub
   • DVPC peering
   • ENAT gateway

   Show answer

   Answer: AB

   Explanation

   C. AWS VPN CloudHub - this is hub-and-spoke solution to connect multiple sites. D. VPC peering - this is to connect cloud VPC to VPC. E. NAT gateway - public or private NAT gateway? the public type is to access the internet, and a private NAT gateway is often used for communication between VPCs or between VPCs and Transit Gateway.

   Source: Adapted from community discussion — Daniel76

   References

   • AWS documentation

   Next question

3. Question 443 · 732 in bank

   A company needs to retain log data archives for several years to be compliant with regulations. The log data is no longer used, but it must be retained. What is the MOST secure and cost-effective solution to meet these requirements?

   • AArchive the data to Amazon S3 and apply a restrictive bucket policy to deny the s3:DeleteObject API.
   • BArchive the data to Amazon S3 Glacier and apply a Vault Lock policy.
   • CArchive the data to Amazon S3 and replicated it to a second bucket in a second AWS Region. Choose the S3 Standard-Infrequent Access (S3 Standard-IA) storage class and apply a restrictive bucket policy to deny the s3:DeleteObject API.
   • DMigrate the log data to a 16 TB Amazon Elastic Block Store (Amazon EBS) volume. Create a snapshot of the EBS volume.

   Show answer

   Answer: B

   Next question

4. Question 444 · 732 in bank

   A security engineer is checking an AWS CloudFormation template for vulnerabilities. The security engineer finds a parameter that has a default value that exposes an application's API key in plaintext. The parameter is referenced several times throughout the template. The security engineer must replace the parameter while maintaining the ability to reference the value in the template. Which solution will meet these requirements in the MOST secure way?

   • AStore the API key value as a SecureString parameter in AWS Systems Manager Parameter Store. In the template, replace all references to the value with {{resolve:ssm:MySSMParameterName:1}}.
   • BStore the API key value in AWS Secrets Manager. In the template, replace all references to the value with {{resolve:secretsmanager:MySecretId:SecretString}}.
   • CStore the API key value in Amazon DynamoDB. In the template, replace all references to the value with {{resolve:dynamodb:MyTableName:MyPrimaryKey}}.
   • DStore the API key value in a new Amazon S3 bucket. In the template, replace all references to the value with {{resolve:s3:MyBucketName:MyObjectName}}.

   Show answer

   Answer: B

   Explanation

   Agree answer B. Not A. {{resolve:ssm:MySSMParameterName:1}} ssm: Systems Manager Parameter Store plaintext parameter. ssm-secure: Systems Manager Parameter Store secure string parameter. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html

   Source: Adapted from community discussion — 100fold

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 445 · 732 in bank

   Select 3

   A company's AWS CloudTrail logs are all centrally stored in an Amazon S3 bucket. The security team controls the company's AWS account. The security team must prevent unauthorized access and tampering of the CloudTrail logs. Which combination of steps should the security team take? (Choose three.)

   • AConfigure server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
   • BCompress log files with secure gzip.
   • CCreate an Amazon EventBridge rule to notify the security team of any modifications on CloudTrail log files.
   • DImplement least privilege access to the S3 bucket by configuring a bucket policy.
   • EConfigure CloudTrail log file integrity validation.
   • FConfigure Access Analyzer for S3.

   Show answer

   Answer: ADE

   Explanation

   Here's what it describes about the usage of log file integration and the SSE-KMS usecase scenario: "If you use SSE-KMS and log file validation, and you have modified your Amazon S3 bucket policy to only allow SSE-KMS encrypted files, you will not be able to create trails that utilize that bucket unless you modify your bucket policy to specifically allow AES256 encryption, as shown in the following example policy line. "StringNotEquals": { "s3:x-amz-server-side-encryption": ["aws:kms", "AES256"] } "

   Source: Adapted from community discussion — Aamee

   References

   • AWS documentation

   Next question

6. Question 446 · 732 in bank

   A company website runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group across multiple Availability Zones. There is an Amazon CloudFront distribution in front of the ALB. Users are reporting performance problems. A security engineer discovers that the website is receiving a high rate of unwanted requests to the CloudFront distribution originating from a series of source IP addresses. How should the security engineer address this problem?

   • AUsing AWS Shield, configure a deny rule with an IP match condition containing the source IPs of the unwanted requests.
   • BUsing Auto Scaling, configure the maximum an instance value to an increased count that will absorb the unwanted requests.
   • CUsing an Amazon VPC NACL, configure an inbound deny rule for each source IP CIDR address of the unwanted requests.
   • DUsing AWS WAF, configure a web ACL rate-based rule on the CloudFront distribution with a rate limit below that of the unwanted requests.

   Show answer

   Answer: D

   Next question

7. Question 447 · 732 in bank

   A company has several petabytes of data. The company must preserve this data for 7 years to comply with regulatory requirements. The company's compliance team asks a security officer to develop a strategy that will prevent anyone from changing or deleting the data. Which solution will meet this requirement MOST cost-effectively?

   • ACreate an Amazon S3 bucket. Configure the bucket to use S3 Object Lock in compliance mode. Upload the data to the bucket. Create a resource-based bucket policy that meets all the regulatory requirements.
   • BCreate an Amazon S3 bucket. Configure the bucket to use S3 Object Lock in governance mode. Upload the data to the bucket. Create a user-based IAM policy that meets all the regulatory requirements.
   • CCreate a vault in Amazon S3 Glacier. Create a Vault Lock policy in S3 Glacier that meets all the regulatory requirements. Upload the data to the vault.
   • DCreate an Amazon S3 bucket. Upload the data to the bucket. Use a lifecycle rule to transition the data to a vault in S3 Glacier. Create a Vault Lock policy that meets all the regulatory requirements.

   Show answer

   Answer: C

   Explanation

   To meet the requirement of preserving several petabytes of data for 7 years in a cost-effective manner while ensuring that the data cannot be changed or deleted, option C is the most suitable solution. Here's why: Creating a vault in Amazon S3 Glacier and implementing a Vault Lock policy ensures that the data is stored using a write-once-read-many (WORM) model, which prevents any changes or deletions during the specified retention period. S3 Glacier is designed for long-term storage of infrequently accessed data, making it a cost-effective choice for this use case. The Vault Lock policy will enforce compliance with regulatory requirements by ensuring that the data remains immutable for the entire retention period. This approach leverages the cost benefits of S3 Glacier for long-term storage while providing the necessary security and compliance features to meet the company's requirements.

   Source: Adapted from community discussion — IPLogic

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 448 · 732 in bank

   Select 2

   A developer is building a serverless application hosted on AWS that uses Amazon Redshift as a data store. The application has separate module for read/write and read-only functionality. The modules need their own database users for compliance reasons. Which combination of steps should a security engineer implement to grant appropriate access? (Choose two.)

   • AConfigure cluster security groups for each application module to control access to database users that are required for read-only and read-write.
   • BConfigure a VPC endpoint for Amazon Redshift. Configure an endpoint policy that maps database users to each application module, and allow access to the tables that are required for read-only and read/write.
   • CConfigure an IAM policy for each module. Specify the ARN of an Amazon Redshift database user that allows the GetClusterCredentials API call.
   • DCreate local database users for each module.
   • EConfigure an IAM policy for each module. Specify the ARN of an IAM user that allows the GetClusterCredentials API call.

   Show answer

   Answer: CD

   Next question

9. Question 449 · 732 in bank

   A-company uses a third-party identity provider and SAML-based SSO for its AWS accounts. After the third-party identity provider renewed an expired signing certificate, users saw the following message when trying to log in: Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken) A security engineer needs to provide a solution that corrects the error and minimizes operational overhead. Which solution meets these requirements?

   • AUpload the third-party signing certificate’s new private key to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS Management Console.
   • BSign the identity provider's metadata file with the new public key. Upload the signature to the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.
   • CDownload the updated SAML metadata file from the identity service provider. Update the file in the AWS identity provider entity defined in AWS Identity and Access Management (IAM) by using the AWS CLI.
   • DConfigure the AWS identity provider entity defined in AWS Identity and Access Management (IAM) to synchronously fetch the new public key by using the AWS Management Console.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

10. Question 450 · 732 in bank

    A company has two software development teams that are creating applications that store sensitive data in Amazon S3. Each team's data must always be separate. The company's security team must design a data encryption strategy for both teams that provides the ability to audit key usage. The solution must also minimize operational overhead. What should the security team recommend?

    • ATell the application teams to use two different S3 buckets with separate AWS Key Management Service (AWS KMS) AWS managed CMKs. Limit the key policies to allow encryption and decryption of the CMKs to their respective teams only. Force the teams to use encryption context to encrypt and decrypt.
    • BTell the application teams to use two different S3 buckets with a single AWS Key Management Service (AWS KMS) AWS managed CMK. Limit the key policy to allow encryption and decryption of the CMK only. Do not allow the teams to use encryption context to encrypt and decrypt.
    • CTell the application teams to use two different S3 buckets with separate AWS Key Management Service (AWS KMS) customer managed CMKs. Limit the key policies to allow encryption and decryption of the CMKs to their respective teams only. Force the teams to use encryption context to encrypt and decrypt.
    • DTell the application teams to use two different S3 buckets with a single AWS Key Management Service (AWS KMS) customer managed CMK. Limit the key policy to allow encryption and decryption of the CMK only. Do not allow the teams to use encryption context to encrypt and decrypt.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 441. 732 questions available.