SCS-C02 practice questions 41–50

1. Question 41 · 732 in bank

   Which option for the use of the AWS Key Management Service (KMS) supports key management best practices that focus on minimizing the potential scope of data exposed by a possible future key compromise?

   • AUse KMS automatic key rotation to replace the master key, and use this new master key for future encryption operations without re-encrypting previously encrypted data.
   • BGenerate a new Customer Master Key (CMK), re-encrypt all existing data with the new CMK, and use it for all future encryption operations.
   • CChange the CMK alias every 90 days, and update key-calling applications with the new key alias.
   • DChange the CMK permissions to ensure that individuals who can provision keys are not the same individuals who can use the keys.

   Show answer

   Answer: B

   Next question

2. Question 42 · 732 in bank

   A company has AWS accounts that are in an organization in AWS Organizations. An Amazon S3 bucket in one of the accounts is publicly accessible. A security engineer must change the configuration so that the S3 bucket is no longer publicly accessible. The security engineer also must ensure that the S3 bucket cannot be made publicly accessible in the future. Which solution will meet these requirements?

   • AConfigure the S3 bucket to use an AWS Key Management Service (AWS KMS) key. Encrypt all objects in the S3 bucket by creating a bucket policy that enforces encryption. Configure an SCP to deny the s3:GetObject action for the OU that contains the AWS account.
   • BEnable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:GetObject action for the OU that contains the AWS account.
   • CEnable the PublicAccessBlock configuration on the S3 bucket. Configure an SCP to deny the s3:PutPublicAccessBlock action for the OU that contains the AWS account.
   • DConfigure the S3 bucket to use S3 Object Lock in governance mode. Configure an SCP to deny the s3:PutPublicAccessBlock action for the OU that contains the AWS account.

   Show answer

   Answer: C

   Explanation

   Enable PublicAccessBlock Configuration: https://aws.amazon.com/s3/features/block-public-access/?nc1=h_ls Configure an SCP (Service Control Policy): An SCP is a policy that you can attach to an AWS Organization, organizational unit (OU), or an account. It acts as a guardrail to control permissions across accounts. In your case, you want to deny the s3:PutPublicAccessBlock action for the OU containing your AWS account. Go to the AWS Organizations console. Navigate to the OU that contains your account. Create a new SCP or edit an existing one. Add a statement that denies the s3:PutPublicAccessBlock action for the relevant S3 buckets. Attach the SCP to the OU. Ensure that your AWS account is part of the OU.

   Source: Adapted from community discussion — aescudero51

   References

   • AWS documentation

   Next question

3. Question 43 · 732 in bank

   A Security Engineer must enforce the use of only Amazon EC2, Amazon S3, Amazon RDS, Amazon DynamoDB, and AWS STS in specific accounts. What is a scalable and efficient approach to meet this requirement?

   • ASet up an AWS Organizations hierarchy, and replace the FullAWSAccess policy with the following Service Control Policy for the governed organization units: //IMG//
   • BCreate multiple IAM users for the regulated accounts, and attach the following policy statement to restrict services as required: //IMG//
   • CSet up an Organizations hierarchy, replace the global FullAWSAccess with the following Service Control Policy at the top level: //IMG//
   • DSet up all users in the Active Directory for federated access to all accounts in the company. Associate Active Directory groups with IAM groups, and attach the following policy statement to restrict services as required: //IMG//

   Show answer

   Answer: A

   Next question

4. Question 44 · 732 in bank

   Select 3

   An international company has established a new business entity in South Korea. The company also has established a new AWS account to contain the workload for the South Korean region. The company has set up the workload in the new account in the ap-northeast-2 Region. The workload consists of three Auto Scaling groups of Amazon EC2 instances. All workloads that operate in this Region must keep system logs and application logs for 7 years. A security engineer must implement a solution to ensure that no logging data is lost for each instance during scaling activities. The solution also must keep the logs for only the required period of 7 years. Which combination of steps should the security engineer take to meet these requirements? (Choose three.)

   • AEnsure that the Amazon CloudWatch agent is installed on all the EC2 instances that the Auto Scaling groups launch. Generate a CloudWatch agent configuration file to forward the required logs to Amazon CloudWatch Logs.
   • BSet the log retention for desired log groups to 7 years.
   • CAttach an IAM role to the launch configuration or launch template that the Auto Scaling groups use. Configure the role to provide the necessary permissions to forward logs to Amazon CloudWatch Logs.
   • DAttach an IAM role to the launch configuration or launch template that the Auto Scaling groups use. Configure the role to provide the necessary permissions to forward logs to Amazon S3.
   • EEnsure that a log forwarding application is installed on all the EC2 instances that the Auto Scaling groups launch. Configure the log forwarding application to periodically bundle the logs and forward the logs to Amazon S3.
   • FConfigure an Amazon S3 Lifecycle policy on the target S3 bucket to expire objects after 7 years.

   Show answer

   Answer: ABC

   Explanation

   I would go for ACF if the asked is "COST-EFFECTIVE" solution. But leaning to ABF, as Cloudwatch logs support up to 10yrs of retention as well. Feel free to disagree if you think I'm wrong. https://docs.aws.amazon.com/managedservices/latest/userguide/log-customize-retention.html

   Source: Adapted from community discussion — mav3r1ck

   References

   • AWS documentation

   Next question

5. Question 45 · 732 in bank

   A company's database developer has just migrated an Amazon RDS database credential to be stored and managed by AWS Secrets Manager. The developer has also enabled rotation of the credential within the Secrets Manager console and set the rotation to change every 30 days. After a short period of time, a number of existing applications have failed with authentication errors. What is the MOST likely cause of the authentication errors?

   • AMigrating the credential to RDS requires that all access come through requests to the Secrets Manager.
   • BEnabling rotation in Secrets Manager causes the secret to rotate immediately, and the applications are using the earlier credential.
   • CThe Secrets Manager IAM policy does not allow access to the RDS database.
   • DThe Secrets Manager IAM policy does not allow access for the applications.

   Show answer

   Answer: B

   Next question

6. Question 46 · 732 in bank

   Select 2

   A company is designing a new application stack. The design includes web servers and backend servers that are hosted on Amazon EC2 instances. The design also includes an Amazon Aurora MySQL DB cluster. The EC2 instances are in an Auto Scaling group that uses launch templates. The EC2 instances for the web layer and the backend layer are backed by Amazon Elastic Block Store (Amazon EBS) volumes. No layers are encrypted at rest A security engineer needs to implement encryption at rest. Which combination of steps will meet these requirements? (Choose two.)

   • AModify EBS default encryption settings in the target AWS Region to enable encryption. Use an Auto Scaling group instance refresh.
   • BModify the launch templates for the web layer and the backend layer to add AWS Certificate Manager (ACM) encryption for the attached EBS volumes. Use an Auto Scaling group instance refresh.
   • CCreate a new AWS Key Management Service (AWS KMS) encrypted DB cluster from a snapshot of the existing DB cluster.
   • DApply AWS Key Management Service (AWS KMS) encryption to the existing DB cluster.
   • EApply AWS Certificate Manager (ACM) encryption to the existing DB cluster.

   Show answer

   Answer: AC

   Explanation

   A/C B - You don't use ACM for encryption, it's KMS D - You can't encrypt an existing cluster, you need to snapshot, then encrypt with KMS E - Same as B

   Source: Adapted from community discussion — aescudero51

   Next question

7. Question 47 · 732 in bank

   A Security Engineer launches two Amazon EC2 instances in the same Amazon VPC but in separate Availability Zones. Each instance has a public IP address and is able to connect to external hosts on the internet. The two instances are able to communicate with each other by using their private IP addresses, but they are not able to communicate with each other when using their public IP addresses. Which action should the Security Engineer take to allow communication over the public IP addresses?

   • AAssociate the instances to the same security groups.
   • BAdd 0.0.0.0/0 to the egress rules of the instance security groups.
   • CAdd the instance IDs to the ingress rules of the instance security groups.
   • DAdd the public IP addresses to the ingress rules of the instance security groups.

   Show answer

   Answer: D

   Next question

8. Question 48 · 732 in bank

   Select 2

   A company uses SAML federation with AWS Identity and Access Management (IAM) to provide internal users with SSO for their AWS accounts. The company's identity provider certificate was rotated as part of its normal lifecycle Shortly after users started receiving the following error when attempting to log in: “Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken)” A security engineer needs to address the immediate issue and ensure that it will not occur again. Which combination of steps should the security engineer take to accomplish this? (Choose two.)

   • ADownload a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity.
   • BDuring the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
   • CDownload a new copy of the SAML metadata file from the identity provider. Upload the new metadata to the IAM identity provider entity configured for the SAML integration in question.
   • DDuring the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new copy of the metadata file and create a new IAM identity provider entity. Upload the metadata file to the new IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
   • EDownload a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity. Update the identity provider configurations to pass a new IAM identity provider entity name in the SAML assertion.

   Show answer

   Answer: BC

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 49 · 732 in bank

   The Security Engineer is managing a web application that processes highly sensitive personal information. The application runs on Amazon EC2. The application has strict compliance requirements, which instruct that all incoming traffic to the application is protected from common web exploits and that all outgoing traffic from the EC2 instances is restricted to specific whitelisted URLs. Which architecture should the Security Engineer use to meet these requirements?

   • AUse AWS Shield to scan inbound traffic for web exploits. Use VPC Flow Logs and AWS Lambda to restrict egress traffic to specific whitelisted URLs.
   • BUse AWS Shield to scan inbound traffic for web exploits. Use a third-party AWS Marketplace solution to restrict egress traffic to specific whitelisted URLs.
   • CUse AWS WAF to scan inbound traffic for web exploits. Use VPC Flow Logs and AWS Lambda to restrict egress traffic to specific whitelisted URLs.
   • DUse AWS WAF to scan inbound traffic for web exploits. Use a third-party AWS Marketplace solution to restrict egress traffic to specific whitelisted URLs.

   Show answer

   Answer: D

   Next question

10. Question 50 · 732 in bank

    A company is implementing a new application in a new AWS account. A VPC and subnets have been created for the application. The application has been peered to an existing VPC in another account in the same AWS Region for database access Amazon EC2 instances will regularly be created and terminated in the application VPC, but only some of them will need access to the databases in the peered VPC over TCP port 1521. A security engineer must ensure that only the EC2 instances that need access to the databases can access them through the network. How can the security engineer implement this solution?

    • ACreate a new security group in the database VPC and create an inbound rule that allows all traffic from the IP address range of the application VPC. Add a new network ACL rule on the database subnets. Configure the rule to TCP port 1521 from the IP address range of the application VPC. Attach the new security group to the database instances that the application instances need to access.
    • BCreate a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Create a new security group in the database VPC with an inbound rule that allows the IP address range of the application VPC over port 1521. Attach the new security group to the database instances and the application instances that need database access.
    • CCreate a new security group in the application VPC with no inbound rules. Create a new security group in the database VPC with an inbound rule that allows TCP port 1521 from the new application security group in the application VPAttach the application security group to the application instances that need database access and attach the database security group to the database instances.
    • DCreate a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Add a new network ACL rule on the database subnets. Configure the rule to allow all traffic from the IP address range of the application VPC. Attach the new security group to the application instances that need database access.

    Show answer

    Answer: C

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 41. 732 questions available.