SCS-C02 practice questions 491–500

1. Question 491 · 732 in bank

   A company maintains an open-source application that is hosted on a public GitHub repository. While creating a new commit to the repository, an engineer uploaded their AWS access key and secret access key. The engineer reported the mistake to a manager, and the manager immediately disabled the access key. The company needs to assess the impact of the exposed access key. A security engineer must recommend a solution that requires the least possible managerial overhead. Which solution meets these requirements?

   • AAnalyze an AWS Identity and Access Management (IAM) use report from AWS Trusted Advisor to see when the access key was last used.
   • BAnalyze Amazon CloudWatch Logs for activity by searching for the access key.
   • CAnalyze VPC flow logs for activity by searching for the access key.
   • DAnalyze a credential report in AWS Identity and Access Management (IAM) to see when the access key was last used.

   Show answer

   Answer: D

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 492 · 732 in bank

   A company plans to create individual child accounts within an existing organization in AWS Organizations for each of its DevOps teams. AWS CloudTrail has been enabled and configured on all accounts to write audit logs to an Amazon S3 bucket in a centralized AWS account. A security engineer needs to ensure that DevOps team members are unable to modify or disable this configuration. How can the security engineer meet these requirements?

   • ACreate an IAM policy that prohibits changes to the specific CloudTrail trail and apply the policy to the AWS account root user.
   • BCreate an S3 bucket policy in the specified destination account for the CloudTrail trail that prohibits configuration changes from the AWS account root user in the source account.
   • CCreate an SCP that prohibits changes to the specific CloudTrail trail and apply the SCP to the appropriate organizational unit or account in Organizations.
   • DCreate an IAM policy that prohibits changes to the specific CloudTrail trail and apply the policy to a new IAM group. Have team members use individual IAM accounts that are members of the new IAM group.

   Show answer

   Answer: C

   Next question

3. Question 493 · 732 in bank

   A company's policy requires that all API keys be encrypted and stored separately from source code in a centralized security account. This security account is managed by the company's security team. However, an audit revealed that an API key is stored with the source code of an AWS Lambda function in an AWS CodeCommit repository in the DevOps account. How should the security team securely store the API key?

   • ACreate a CodeCommit repository in the security account using AWS Key Management Service (AWS KMS) for encryption. Require the development team to migrate the Lambda source code to this repository.
   • BStore the API key in an Amazon S3 bucket in the security account using server-side encryption with Amazon S3 managed encryption keys (SSE-S3) to encrypt the key. Create a presigned URL for the S3 key, and specify the URL in a Lambda environmental variable in the AWS CloudFormation template. Update the Lambda function code to retrieve the key using the URL and call the API.
   • CCreate a secret in AWS Secrets Manager in the security account to store the API key using AWS Key Management Service (AWS KMS) for encryption. Grant access to the IAM role used by the Lambda function so that the function can retrieve the key from Secrets Manager and call the API.
   • DCreate an encrypted environment variable for the Lambda function to store the API key using AWS Key Management Service (AWS KMS) for encryption. Grant access to the IAM role used by the Lambda function so that the function can decrypt the key at runtime.

   Show answer

   Answer: C

   Explanation

   Correct answer is C. Secrets Manager to store API key securely using KMS key. Grant access to KSM key to Lambda exec role.

   Source: Adapted from community discussion — Raphaello

   Next question

4. Question 494 · 732 in bank

   A company has deployed Amazon GuardDuty and now wants to implement automation for potential threats. The company has decided to start with RDP brute force attacks that come from Amazon EC2 instances in the company's AWS environment. A security engineer needs to implement a solution that blocks the detected communication from a suspicious instance until investigation and potential remediation can occur. Which solution will meet these requirements?

   • AConfigure GuardDuty to send the event to an Amazon Kinesis data stream. Process the event with an Amazon Kinesis Data Analytics for Apache Flink application that sends a notification to the company through Amazon Simple Notification Service (Amazon SNS). Add rules to the network ACL to block traffic to and from the suspicious instance.
   • BConfigure GuardDuty to send the event to Amazon EventBridge. Deploy an AWS WAF web ACL. Process the event with an AWS Lambda function that sends a notification to the company through Amazon Simple Notification Service (Amazon SNS) and adds a web ACL rule to block traffic to and from the suspicious instance.
   • CEnable AWS Security Hub to ingest GuardDuty findings and send the event to Amazon EventBridge. Deploy AWS Network Firewall. Process the event with an AWS Lambda function that adds a rule to a Network Firewall firewall policy to block traffic to and from the suspicious instance.
   • DEnable AWS Security Hub to ingest GuardDuty findings. Configure an Amazon Kinesis data stream as an event destination for Security Hub. Process the event with an AWS Lambda function that replaces the security group of the suspicious instance with a security group that does not allow any connections.

   Show answer

   Answer: C

   Explanation

   Let Guardduty detections be sent to Security Hub as findings is a simple and elegant way. https://docs.aws.amazon.com/guardduty/latest/ug/securityhub-integration.html Use eventbridge to respond by invoke Lambda. Amazon Kinesis data stream not needed. https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cloudwatch-events.html Suggest to only block specific port 389 against thse suspicious EC2 instance instead of isolate it in a security group, to minimize the impact while it has not been verified as a confirmed attack.

   Source: Adapted from community discussion — Daniel76

   References

   • AWS documentation
   • AWS documentation
   • repost.aws documentation
   • AWS documentation

   Next question

5. Question 495 · 732 in bank

   Select 2

   A user in account 111122223333 is receiving an access denied error message while calling the AWS Key Management Service (AWS KMS) GenerateDataKey API operation. The key policy contains the following statement:

   

   Account 111122223333 is not using AWS Organizations SCPs. Which combination of steps should a security engineer take to ensure that KMSUser can perform the action on the key? (Choose two.)

   • AModify the key policy to include the key's key ID in the Resource field.
   • BVerify that KMSUser has no explicit denies for the GenerateDataKey action in its attached IAM policies.
   • CVerify that KMSUser is allowed to perform the GenerateDataKey action in its attached IAM policies for the encryption context.
   • DEnsure that KMSUser is including the encryption context key-value pair in its GenerateDataKey.
   • ERevoke any KMS grants on the key that are denying the GenerateDataKey action for KMSUser.

   Show answer

   Answer: BD

   Next question

6. Question 496 · 732 in bank

   A security engineer is asked to update an AWS CloudTrail log file prefix for an existing trail. When attempting to save the change in the CloudTrail console, the security engineer receives the following error message: "There is a problem with the bucket policy." What will enable the security engineer to save the change?

   • ACreate a new trail with the updated log file prefix, and then delete the original trail. Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail console.
   • BUpdate the existing bucket policy in the Amazon S3 console to allow the security engineer's principal to perform PutBucketPolicy, and then update the log file prefix in the CloudTrail console.
   • CUpdate the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail console.
   • DUpdate the existing bucket policy in the Amazon S3 console to allow the security engineer's principal to perform GetBucketPolicy, and then update the log file prefix in the CloudTrail console.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

7. Question 497 · 732 in bank

   A company is building an application on AWS that will store sensitive information. The company has a support team with access to the IT infrastructure, including databases. The company's security engineer must introduce measures to protect the sensitive data against any data breach while minimizing management overhead. The credentials must be regularly rotated. What should the security engineer recommend?

   • AEnable Amazon RDS encryption to encrypt the database and snapshots. Enable Amazon Elastic Block Store (Amazon EBS) encryption on Amazon EC2 instances. Include the database credential in the EC2 user data field. Use an AWS Lambda function to rotate database credentials. Set up TLS for the connection to the database.
   • BInstall a database on an Amazon EC2 instance. Enable third-party disk encryption to encrypt Amazon Elastic Block Store (Amazon EBS) volume. Store the database credentials in AWS CloudHSM with automatic rotation. Set up TLS for the connection to the database.
   • CEnable Amazon RDS encryption to encrypt the database and snapshots. Enable Amazon Elastic Block Store (Amazon EBS) encryption on Amazon EC2 instances. Store the database credentials in AWS Secrets Manager with automatic rotation. Set up TLS for the connection to the RDS hosted database.
   • DSet up an AWS CloudHSM cluster with AWS Key Management Service (AWS KMS) to store KMS keys. Set up Amazon RDS encryption using AWS KSM to encrypt the database. Store the database credentials in AWS Systems Manager Parameter Store with automatic rotation. Set up TLS for the connection to the RDS hosted database.

   Show answer

   Answer: C

   Next question

8. Question 498 · 732 in bank

   A company uses AWS Organizations. The company wants to implement short-term credentials for third-party AWS accounts to use to access accounts within the company's organization. Access is for the AWS Management Console and third-party software-as-a-service (SaaS) applications. Trust must be enhanced to prevent two external accounts from using the same credentials. The solution must require the least possible operational effort. Which solution will meet these requirements?

   • AUse a bearer token authentication with OAuth or SAML to manage and share a central Amazon Cognito user pool across multiple Amazon API Gateway APIs.
   • BImplement AWS IAM Identity Center (AWS Single Sign-On), and use an identity source of choice. Grant access to users and groups from other accounts by using permission sets that are assigned by account.
   • CCreate a unique IAM role for each external account. Create a trust policy Use AWS Secrets Manager to create a random external key.
   • DCreate a unique IAM role for each external account. Create a trust policy that includes a condition that uses the sts:ExternalId condition key.

   Show answer

   Answer: D

   Explanation

   What is an external ID: An external ID is a unique identifier that is managed by a third-party identity provider (IdP). It's used to verify the identity of a user without requiring them to have an AWS IAM account. Creating a role with an external ID: You can create a role in your AWS account and specify an external ID source (e.g., SAML provider, OIDC provider). You can define trust relationships between the role and the external IdP. This ensures that only authorized users with the correct external ID can assume the role. You can attach IAM policies to the role to grant specific permissions to access AWS resources.

   Source: Adapted from community discussion — WeepingMaplte

   References

   • AWS documentation

   Next question

9. Question 499 · 732 in bank

   A company is developing a mobile shopping web app. The company needs an environment that is configured to encrypt all resources in transit and at rest. A security engineer must develop a solution that will encrypt traffic in transit to the company's Application Load Balancer and Amazon API Gateway resources. The solution also must encrypt traffic at rest for Amazon S3 storage. What should the security engineer do to meet these requirements?

   • AUse AWS Certificate Manager (ACM) for encryption in transit. Use AWS Key Management Service for encryption at rest.
   • BUse AWS Certificate Manager (ACM) for encryption in transit and encryption at rest.
   • CUse AWS Key Management Service for encryption in transit. Use AWS Certificate Manager (ACM) for encryption at rest.
   • DUse AWS Key Management Service for encryption in transit and encryption at rest.

   Show answer

   Answer: A

   Next question

10. Question 500 · 732 in bank

    A company is evaluating its security posture. In the past, the company has observed issues with specific hosts and host header combinations that affected the company's business. The company has configured AWS WAF web ACLs as an initial step to mitigate these issues. The company must create a log analysis solution for the AWS WAF web ACLs to monitor problematic activity. The company wants to process all the AWS WAF logs in a central location. The company must have the ability to filter out requests based on specific hosts. A security engineer starts to enable access logging for the AWS WAF web ACLs. What should the security engineer do next to meet these requirements with the MOST operational efficiency?

    • ASpecify Amazon Redshift as the destination for the access logs. Deploy the Amazon Athena Redshift connector. Use Athena to query the data from Amazon Redshift and to filter the logs by host.
    • BSpecify Amazon CloudWatch as the destination for the access logs. Use Amazon CloudWatch Logs Insights to design a query to filter the logs by host.
    • CSpecify Amazon CloudWatch as the destination for the access logs. Export the CloudWatch logs to an Amazon S3 bucket. Use Amazon Athena to query the logs and to filter the logs by host.
    • DSpecify Amazon CloudWatch as the destination for the access logs. Use Amazon Redshift Spectrum to query the logs and to filter the logs by host.

    Show answer

    Answer: B

    Explanation

    B. CloudWatch Logs Insights is a fully managed service that enables you to search and analyze your log data efficiently. It allows you to interactively explore and analyze your logs directly in the CloudWatch console. Operational Efficiency: CloudWatch is a native AWS service that can directly receive and store AWS WAF access logs. Using CloudWatch Logs Insights, you can design and run queries to filter logs based on specific hosts. This provides a quick and efficient way to analyze and monitor AWS WAF logs centrally. Options C and D involve additional steps such as exporting logs to S3 or using Amazon Redshift Spectrum, which may introduce additional complexity and operational overhead. Option A suggests using Amazon Redshift directly, which may not be the most efficient option for log analysis in this scenario. Therefore, option B is the most operationally efficient solution for analyzing and filtering AWS WAF access logs in a central location.

    Source: Adapted from community discussion — vikasj1in

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 491. 732 questions available.