SCS-C02 practice questions 471–480

1. Question 471 · 732 in bank

   A company is using Amazon Route 53 Resolver for its hybrid DNS infrastructure. The company has set up Route 53 Resolver forwarding rules for authoritative domains that are hosted on on-premises DNS servers. A new security mandate requires the company to implement a solution to log and query DNS traffic that goes to the on-premises DNS servers. The logs must show details of the source IP address of the instance from which the query originated. The logs also must show the DNS name that was requested in Route 53 Resolver. Which solution will meet these requirements?

   • AUse VPC Traffic Mirroring. Configure all relevant elastic network interfaces as the traffic source, include amazon-dns in the mirror filter, and set Amazon CloudWatch Logs as the mirror target. Use CloudWatch Insights on the mirror session logs to run queries on the source IP address and DNS name.
   • BConfigure VPC flow logs on all relevant VPCs. Send the logs to an Amazon S3 bucket. Use Amazon Athena to run SQL queries on the source IP address and DNS name.
   • CConfigure Route 53 Resolver query logging on all relevant VPCs. Send the logs to Amazon CloudWatch Logs. Use CloudWatch Insights to run queries on the source IP address and DNS name.
   • DModify the Route 53 Resolver rules on the authoritative domains that forward to the on-premises DNS servers. Send the logs to an Amazon S3 bucket. Use Amazon Athena to run SQL queries on the source IP address and DNS name.

   Show answer

   Answer: C

   Explanation

   C is the only answer as you need to config resolver query logging on all vpc, and cloudwatch log insight indeed allow you to query the source IP address. https://aws.amazon.com/blogs/aws/log-your-vpc-dns-queries-with-route-53-resolver-query-logs/

   Source: Adapted from community discussion — Daniel76

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • repost.aws documentation

   Next question

2. Question 472 · 732 in bank

   Select 2

   Unapproved changes were previously made to a company's Amazon S3 bucket. A security engineer configured AWS Config to record configuration changes made to the company's S3 buckets. The engineer discovers there are S3 configuration changes being made, but no Amazon SNS notifications are being sent. The engineer has already checked the configuration of the SNS topic and has confirmed the configuration is valid. Which combination of steps should the security engineer take to resolve the issue? (Choose two.)

   • AConfigure the S3 bucket ACLs to allow AWS Config to record changes to the buckets.
   • BConfigure policies attached to S3 buckets to allow AWS Config to record changes to the buckets.
   • CAttach the AmazonS3ReadOnlyAccess managed policy to IAM User.
   • DVerify the security engineer's IAM user has an attached policy that allows all AWS Config actions.
   • EAssign the AWSConfigRole managed policy to the AWS Config role.

   Show answer

   Answer: BE

   Next question

3. Question 473 · 732 in bank

   Select 2

   A security engineer is configuring account-based access control (ABAC) to allow only specific principals to put objects into an Amazon S3 bucket. The principals already have access to Amazon S3. The security engineer needs to configure a bucket policy that allows principals to put objects into the S3 bucket only if the value of the Team tag on the object matches the value of the Team tag that is associated with the principal. During testing, the security engineer notices that a principal can still put objects into the S3 bucket when the tag values do not match. Which combination of factors are causing the PutObject operation to succeed when the tag values are different? (Choose two.)

   • AThe principal's identity-based policy grants access to put objects into the S3 bucket with no conditions.
   • BThe principal's identity-based policy overrides the condition because the identity-based policy contains an explicit allow.
   • CThe S3 bucket's resource policy does not deny access to put objects.
   • DThe S3 bucket's resource policy cannot allow actions to the principal.
   • EThe bucket policy does not apply to principals in the same zone of trust.

   Show answer

   Answer: AC

   Explanation

   https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html Look out for step 2- create ABAC policy example. To ensure that resources is only granted when principal and resource tag match, there should be condition for the access, and disallow when tag not match.

   Source: Adapted from community discussion — Daniel76

   References

   • AWS documentation

   Next question

4. Question 474 · 732 in bank

   A security engineer must develop an encryption tool for a company. The company requires a cryptographic solution that supports the ability to perform cryptographic erasure on all resources protected by the key material in 15 minutes or less. Which Aws Key Management Service (AWS KMS) key solution will allow the security engineer to meet these requirements?

   • AUse imported key material with CMK.
   • BUse an AWS KMS CMK.
   • CUse an AWS managed CMK.
   • DUse an AWS KMS customer managed CMK.

   Show answer

   Answer: A

   Next question

5. Question 475 · 732 in bank

   A company is hosting multiple applications within a single VPC in its AWS account. The applications are running behind an Application Load Balancer that is associated with an AWS WAF web ACL. The company's security team has identified that multiple port scans are originating from a specific range of IP addresses on the internet. A security engineer needs to deny access from the offending IP addresses. Which solution will meet these requirements?

   • AModify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests from the IP address range.
   • BAdd a rule to all security groups to deny the incoming requests from the IP address range.
   • CModify the AWS WAF web ACL with a rate-based rule statement to deny the incoming requests from the IP address range.
   • DConfigure the AWS WAF web ACL with regex match conditions. Specify a pattern set to deny the incoming requests based on the match condition.

   Show answer

   Answer: A

   Explanation

   You will use rate limit if it is normal HTTP/s traffic. For port scanning is a network reconnaissance technique used to identify which ports on a computer system are open and potentially vulnerable. You will want to block it 100%.

   Source: Adapted from community discussion — WeepingMaplte

   References

   • AWS documentation

   Next question

6. Question 476 · 732 in bank

   After a recent security audit involving Amazon S3, a company has asked for assistance reviewing its S3 buckets to determine whether the data is properly secured. The first S3 bucket on the list has the following bucket policy:

   

   In this bucket policy sufficient to ensure that the data is not publicly accessible?

   • AYes, the bucket policy makes the whole bucket publicly accessible despite how the S3 bucket ACL or object ACLs are configured.
   • BYes, none of the data in the bucket is publicly accessible, regardless of how the S3 bucket ACL or object ACLs are configured.
   • CNo, the IAM user policy would need to be examined first to determine whether any data is publicly accessible.
   • DNo, the S3 bucket ACL and object ACLs need to be examined first to determine whether any data is publicly accessible.

   Show answer

   Answer: D

   Next question

7. Question 477 · 732 in bank

   A company needs a security engineer to implement a scalable solution for multi-account authentication and authorization. The solution should not introduce additional user-managed architectural components. Native AWS features should be used as much as possible. The security engineer has set up AWS Organizations with all features activated and AWS IAM Identity Center (AWS Single Sign-On) enabled. Which additional steps should the security engineer take to complete the task?

   • AUse AD Connector to create users and groups for all employees that require access to AWS accounts. Assign AD Connector groups to AWS accounts and link to the IAM roles in accordance with the employees’ job functions and access requirements. Instruct employees to access AWS accounts by using the AWS Directory Service user portal.
   • BUse an IAM Identity Center default directory to create users and groups for all employees that require access to AWS accounts. Assign groups to AWS accounts and link to permission sets in accordance with the employees’ job functions and access requirements. Instruct employees to access AWS accounts by using the IAM Identity Center user portal.
   • CUse an IAM Identity Center default directory to create users and groups for all employees that require access to AWS accounts. Link IAM Identity Center groups to the IAM users present in all accounts to inherit existing permissions. Instruct employees to access AWS accounts by using the IAM Identity Center user portal.
   • DUse AWS Directory Service for Microsoft Active Directory to create users and groups for all employees that require access to AWS accounts. Enable AWS Management Console access in the created directory and specify IAM Identity Center as a source of information for integrated accounts and permission sets. Instruct employees to access AWS accounts by using the AWS Directory Service user portal.

   Show answer

   Answer: B

   Explanation

   A. AD Connector only provides connectivity, not managing users. C. IAM users should not need to be created in all accounts - results in admin overhead. assume role instead. D. Letting end users DIY access in AWS Management Console, AWS Directory Service user portal is not a good idea.

   Source: Adapted from community discussion — Daniel76

   References

   • AWS documentation

   Next question

8. Question 478 · 732 in bank

   A company needs to encrypt all of its data stored in Amazon S3. The company wants to use AWS Key Management Service (AWS KMS) to create and manage its encryption keys. The company's security policies require the ability to import the company's own key material for the keys, set an expiration date on the keys, and delete keys immediately, if needed. How should a security engineer set up AWS KMS to meet these requirements?

   • AConfigure AWS KMS and use a custom key store. Create a customer managed CMK with no key material. Import the company's keys and key material into the CMK.
   • BConfigure AWS KMS and use the default key store. Create an AWS managed CMK with no key material. Import the company's keys and key material into the CMK.
   • CConfigure AWS KMS and use the default key store. Create a customer managed CMK with no key material. Import the company's keys and key material into the CMK.
   • DConfigure AWS KMS and use a custom key store. Create an AWS managed CMK with no key material. Import the company's keys and key material into the CMK.

   Show answer

   Answer: C

   Next question

9. Question 479 · 732 in bank

   Select 3

   A company has a group of Amazon EC2 instances in a single private subnet of a VPC with no internet gateway attached. A security engineer has installed the Amazon CloudWatch agent on all instances in that subnet to capture logs from a specific application. To ensure that the logs flow securely, the company's networking team has created VPC endpoints for CloudWatch monitoring and CloudWatch logs. The networking team has attached the endpoints to the VPC. The application is generating logs However, when the security engineer queries CloudWatch, the logs do not appear. Which combination of steps should the security engineer take to troubleshoot this issue? (Choose three.)

   • AEnsure that the EC2 instance profile that is attached to the EC2 instances has permissions to create log streams and write logs.
   • BCreate a metric filter on the logs so that they can be viewed in the AWS Management Console.
   • CCheck the CloudWatch agent configuration file on each EC2 instance to make sure that the CloudWatch agent is collecting the proper log files.
   • DCheck the VPC endpoint policies of both VPC endpoints to ensure that the EC2 instances have permissions to use them.
   • ECreate a NAT gateway in the subnet so that the EC2 instances can communicate with CloudWatch.
   • FEnsure that the security groups allow all the EC2 instances to communicate with each other to aggregate logs before sending.

   Show answer

   Answer: ACD

   Next question

10. Question 480 · 732 in bank

    Select 2

    A company has an application that uses an Amazon RDS PostgreSQL database. The company is developing an application feature that will store sensitive information for an individual in the database. During a security review of the environment, the company discovers that the RDS DB instance is not encrypting data at rest. The company needs a solution that will provide encryption at rest for all the existing data and for any new data that is entered for an individual. Which combination of options can the company use to meet these requirements? (Choose two.)

    • ACreate a snapshot of the DB instance. Copy the snapshot to a new snapshot, and enable encryption for the copy process. Use the new snapshot to restore the DB instance.
    • BModify the configuration of the DB instance by enabling encryption. Create a snapshot of the DB instance. Use the snapshot to restore the DB instance.
    • CUse AWS Key Management Service (AWS KMS) to create a new default AWS managed aws/rds key. Select this key as the encryption key for operations with Amazon RDS.
    • DUse AWS Key Management Service (AWS KMS) to create a new CMK. Select this key as the encryption key for operations with Amazon RDS.
    • ECreate a snapshot of the DB instance. Enable encryption on the snapshot. Use the snapshot to restore the DB instance.

    Show answer

    Answer: AD

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 471. 732 questions available.