SCS-C02 practice questions 451–460

1. Question 451 · 732 in bank

   A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The EC2 instances are deployed in a private subnet of a VPC that does not have internet access. The EC2 instances and the S3 buckets are in the same AWS account. The EC2 instances access the S3 buckets through an S3 gateway endpoint that has the default access policy. Each EC2 instance is associated with an instance profile role that has a policy that explicitly allows the s3:GetObject action and the s3:PutObject action for only the required S3 buckets. The company learns that one or more of the EC2 instances are compromised and are exfiltrating data to an S3 bucket that is outside the company's organization in AWS Organizations. A security engineer must implement a solution to stop this exfiltration of data and to keep the EC2 processing job functional. Which solution will meet these requirements?

   • AUpdate the policy on the S3 gateway endpoint to allow the S3 actions only if the values of the aws:ResourceOrgID and aws:PrincipalOrgID condition keys match the company's values.
   • BUpdate the policy on the instance profile role to allow the S3 actions only if the value of the aws:ResourceOrgID condition key matches the company's value.
   • CAdd a network ACL rule to the subnet of the EC2 instances to block outgoing connections on port 443.
   • DApply an SCP on the AWS account to allow the S3 actions only if the values of the aws:ResourceOrgID and aws:PrincipalOrgID condition keys match the company's values.

   Show answer

   Answer: A

   Explanation

   Blocking at the network layer would allow you still have other workloads that can talk to other buckets outside of the account whereas the option D as others have suggested would mean no workload in the account would ever be able to talk to a bucket outside the org which is IMO too restrictive and the solution is not asking for a general solution just to this specific problem. You can also create additional VPC endpoints and bound them to other route tables which don't have this policy as to allow for other architectural possibilities mentioned above,

   Source: Adapted from community discussion — 9bb8cb3

   References

   • AWS documentation
   • repost.aws documentation
   • AWS documentation

   Next question

2. Question 452 · 732 in bank

   A security engineer is designing a solution that will provide end-to-end encryption between clients and Docker containers running in Amazon Elastic Container Service (Amazon ECS). This solution will also handle volatile traffic patterns. Which solution would have the MOST scalability and LOWEST latency?

   • AConfigure a Network Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.
   • BConfigure an Application Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.
   • CConfigure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers.
   • DConfigure Amazon Route to use multivalue answer routing to send traffic to the containers.

   Show answer

   Answer: C

   Next question

3. Question 453 · 732 in bank

   A company that operates in a hybrid cloud environment must meet strict compliance requirements. The company wants to create a report that includes evidence from on-premises workloads alongside evidence from AWS resources. A security engineer must implement a solution to collect, review, and manage the evidence to demonstrate compliance with company policy. Which solution will meet these requirements?

   • ACreate an assessment in AWS Audit Manager from a prebuilt framework or a custom framework. Upload manual evidence from the on-premises workloads. Add the evidence to the assessment. Generate an assessment report after Audit Manager collects the necessary evidence from the AWS resources.
   • BInstall the Amazon CloudWatch agent on the on-premises workloads. Use AWS Config to deploy a conformance pack from a sample conformance pack template or a custom YAML template. Generate an assessment report after AWS Config identifies noncompliant workloads and resources.
   • CSet up the appropriate security standard in AWS Security Hub. Upload manual evidence from the on-premises workloads. Wait for Security Hub to collect the evidence from the AWS resources. Download the list of controls as a .csv file.
   • DInstall the Amazon CloudWatch agent on the on-premises workloads. Create a CloudWatch dashboard to monitor the on-premises workloads and the AWS resources. Run a query on the workloads and resources. Download the results.

   Show answer

   Answer: A

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 454 · 732 in bank

   A company uses an AWS Key Management Service (AWS KMS) CMK to encrypt application data before it is stored. The company's security policy was recently modified to require encryption key rotation annually. A security engineer must ensure that annual global key rotation is enabled for the key without making changes to the application. What should the security engineer do to accomplish this requirement?

   • ACreate new AWS managed keys. Configure the key schedule for the annual rotation. Create an alias to point to the new keys.
   • BEnable automatic annual key rotation for the existing customer managed CMKs. Update the application encryption library to use a new key ID for all encryption operations. Fall back to the old key ID to decrypt data that was encrypted with previous versions of the key.
   • CCreate new AWS managed CMKs. Configure the key schedule for annual rotation. Create an alias to point to the new CMKs.
   • DEnable automatic annual key rotation for the existing customer managed CMKs. Update the application encryption library to use a new key ID for all encryption operations. Create a key grant for the old CMKs and update the code to point to the ARN of the grants.

   Show answer

   Answer: C

   Next question

5. Question 455 · 732 in bank

   Select 2

   A company is collecting AWS CloudTrail log data from multiple AWS accounts by managing individual trails in each account and forwarding log data to a centralized Amazon S3 bucket residing in a log archive account. After CloudTrail introduced support for AWS Organizations trails, the company decided to further centralize management and automate deployment of the CloudTrail logging capability across all of its AWS accounts. The company's security engineer created an AWS Organizations trail in the master account, enabled server-side encryption with AWS KMS managed keys (SSE- KMS) for the log files, and specified the same bucket as the storage location. However, the engineer noticed that logs recorded by the new trail were not delivered to the bucket. Which factors could cause this issue? (Choose two.)

   • AThe CMK key policy does not allow CloudTrail to make encrypt and decrypt API calls against the key.
   • BThe CMK key policy does not allow CloudTrail to make GenerateDatakey API calls against the key.
   • CThe IAM role used by the CloudTrail trail does not have permissions to make PutObject API calls against a folder created for the Organizations trail.
   • DThe S3 bucket policy does not allow CloudTrail to make PutObject API calls against a folder created for the Organizations trail.
   • EThe CMK key policy does not allow the IAM role used by the CloudTrail trail to use the key for cryptographical operations.

   Show answer

   Answer: BD

   Next question

6. Question 456 · 732 in bank

   A company has a web server in the AWS Cloud. The company will store the content for the web server in an Amazon S3 bucket. A security engineer must use an Amazon CloudFront distribution to speed up delivery of the content. None of the files can be publicly accessible from the S3 bucket directly. Which solution will meet these requirements?

   • AConfigure the permissions on the individual files in the S3 bucket so that only the CloudFront distribution has access to them.
   • BCreate an origin access control (OAC). Associate the OAC with the CloudFront distribution. Configure the S3 bucket permissions so that only the OAC can access the files in the S3 bucket.
   • CCreate an S3 role in AWS Identity and Access Management (IAM). Allow only the CloudFront distribution to assume the role to access the files in the S3 bucket.
   • DCreate an S3 bucket policy that uses only the CloudFront distribution ID as the principal and the Amazon Resource Name (ARN) as the target.

   Show answer

   Answer: B

   Explanation

   Option B: When you associate an OAI with a CloudFront distribution, it acts as a pseudo-user for the distribution, and you can configure S3 bucket permissions to grant access only to that OAI. This allows CloudFront to fetch and serve objects from the S3 bucket on behalf of the end-users without making the objects directly accessible from the S3 bucket.

   Source: Adapted from community discussion — nouns

   References

   • AWS documentation

   Next question

7. Question 457 · 732 in bank

   A security engineer logs in to the AWS Lambda console with administrator permissions. The security engineer is trying to view logs in Amazon CloudWatch for a Lambda function that is named myFunction. When the security engineer chooses the option in the Lambda console to view logs in CloudWatch, an "error loading Log Streams" message appears. The IAM policy for the Lambda function's execution role contains the following:

   

   How should the security engineer correct the error?

   • AMove the logs:CreateLogGroup action to the second Allow statement.
   • BAdd the logs:PutDestination action to the second Allow statement.
   • CAdd the logs:GetLogEvents action to the second Allow statement.
   • DAdd the logs:CreateLogStream action to the second Allow statement.

   Show answer

   Answer: D

   Explanation

   Action "logs:GetLogEvents" gets log events from log stream (https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html), but there no log stream on first place! Correct answer is allowing the function to create log stream (through logs:CreateLogStream). D.

   Source: Adapted from community discussion — Raphaello

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 458 · 732 in bank

   A company needs to migrate several applications to AWS. This will require storing more than 5,000 credentials. To meet compliance requirements, the company will use its existing password management system for key rotation, auditing, and integration with third-party secrets containers. The company has a limited budget and is seeking the most cost-effective solution that is still secure. How should the company accomplish this at the LOWEST cost?

   • AConfigure the company's key management solution to integrate with AWS Systems Manager Parameter Store.
   • BConfigure the company's key management solution to integrate with AWS Secrets Manager.
   • CUse an Amazon S3 encrypted bucket to store the secrets and configure the applications with the appropriate roles to access the secrets.
   • DConfigure the company's key management solution to integrate with AWS CloudHSM.

   Show answer

   Answer: A

   Next question

9. Question 459 · 732 in bank

   Select 2

   A company has an application that uses dozens of Amazon DynamoDB tables to store data. Auditors find that the tables do not comply with the company's data protection policy. The company's retention policy states that all data must be backed up twice each month: once at midnight on the 15th day of the month and again at midnight on the 25th day of the month. The company must retain the backups for 3 months. Which combination of steps should a security engineer take to meet these requirements? (Choose two.)

   • AUse the DynamoDB on-demand backup capability to create a backup plan. Configure a lifecycle policy to expire backups after 3 months.
   • BUse AWS DataSync to create a backup plan. Add a backup rule that includes a retention period of 3 months.
   • CUse AWS Backup to create a backup plan. Add a backup rule that includes a retention period of 3 months.
   • DSet the backup frequency by using a cron schedule expression. Assign each DynamoDB table to the backup plan.
   • ESet the backup frequency by using a rate schedule expression. Assign each DynamoDB table to the backup plan.

   Show answer

   Answer: CD

   Explanation

   Wrong! https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/BackupRestore.html It explicitly says "You can use the DynamoDB on-demand backup capability to create full backups of your tables for long-term retention," LONG TERM RETENTION.

   Source: Adapted from community discussion — Raphaello

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 460 · 732 in bank

    A company has a web-based application using Amazon CloudFront and running on Amazon Elastic Container Service (Amazon ECS) behind an Application Load Balancer (ALB). The ALB is terminating TLS and balancing load across ECS service tasks. A security engineer needs to design a solution to ensure that application content is accessible only through CloudFront and that it is never accessible directly. How should the security engineer build the MOST secure solution?

    • AAdd an origin custom header. Set the viewer protocol policy to HTTP and HTTPS. Set the origin protocol policy to HTTPS only. Update the application to validate the CloudFront custom header.
    • BAdd an origin custom header. Set the viewer protocol policy to HTTPS only. Set the origin protocol policy to match viewer. Update the application to validate the CloudFront custom header.
    • CAdd an origin custom header. Set the viewer protocol policy to redirect HTTP to HTTPS. Set the origin protocol policy to HTTP only. Update the application to validate the CloudFront custom header.
    • DAdd an origin custom header. Set the viewer protocol policy to redirect HTTP to HTTPS. Set the origin protocol policy to HTTPS only. Update the application to validate the CloudFront custom header.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 451. 732 questions available.