SCS-C02 practice questions 501–510

1. Question 501 · 732 in bank

   A security team is implementing a centralized logging solution to meet requirements for auditing. The solution must be able to aggregate logs from Amazon CloudWatch and AWS CloudTrail to an account that is controlled by the security team. This approach must be usable across the entire organization in AWS Organizations. Which solution meets these requirements in the MOST operationally efficient manner?

   • AIn each AWS account, create an Amazon Kinesis Data Firehose delivery stream that has a destination of Amazon S3 in the security team's account. Create a subscription for each Amazon CloudWatch Logs log group in each AWS account to the Kinesis Data Firehose delivery stream in the same account. For the organization, create a CloudTrail trail that has a destination of Amazon S3.
   • BIn the security team's account, create an Amazon Kinesis Data Firehose delivery stream that has a destination of Amazon S3 in the same account. Create a subscription for each Amazon CloudWatch Logs log group in each AWS account to the Kinesis Data Firehose delivery stream in the security team's account. For each AWS account, create a CloudTrail trail that has a destination of Amazon S3.
   • CIn each AWS account, create an Amazon Kinesis data stream that has a destination of Amazon S3 in the security team's account. Create a subscription for each Amazon CloudWatch Logs log group in each AWS account to the Kinesis data stream in the same account. For the organization, create a CloudTrail trail that has a destination of Amazon S3.
   • DIn the security team's account, create an Amazon Kinesis data stream that has a destination of Amazon S3 in the same account. Create a subscription for each Amazon CloudWatch Logs log group in each AWS account to the Kinesis data stream in the security team's account. For each AWS account, create a CloudTrail trail that has a destination of Amazon S3.

   Show answer

   Answer: B

   Next question

2. Question 502 · 732 in bank

   Select 2

   A security engineer is trying to use Amazon EC2 Image Builder to create an image of an EC2 instance. The security engineer has configured the pipeline to send logs to an Amazon S3 bucket. When the security engineer runs the pipeline, the build fails with the following error: "AccessDenied: Access Denied status code: 403". The security engineer must resolve the error by implementing a solution that complies with best practices for least privilege access. Which combination of steps will meet these requirements? (Choose two.)

   • AEnsure that the following policies are attached to the IAM role that the security engineer is using·EC2InstanceProfileForImageBuilder, EC2InstanceProfileForImageBuilderECRContainerBuilds, and AmazonSSMManagedInstanceCore.
   • BEnsure that the following policies are attached to the instance profile for the EC2 instance: EC2InstanceProfileForImageBuilder, EC2InstanceProfileForImageBuilderECRContainerBuilds, and AmazonSSMManagedInstanceCore.
   • CEnsure that the AWSImageBuilderFullAccess policy is attached to the instance profile for the EC2 instance.
   • DEnsure that the security engineer's IAM role has the s3:PutObject permission for the S3 bucket.
   • EEnsure that the instance profile for the EC2 instance has the s3:PutObject permission for the S3 bucket.

   Show answer

   Answer: BE

   Explanation

   Please note that an instance profile is an IAM role for the EC2 instance. Therefore, the option A which states that "IAM role attached to the engineer" is wrong. Please check this link for more information - https://docs.aws.amazon.com/imagebuilder/latest/userguide/troubleshooting.html#ts-access-denied

   Source: Adapted from community discussion — AgboolaKun

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 503 · 732 in bank

   Select 3

   A company needs its Amazon Elastic Block Store (Amazon EBS) volumes to be encrypted at all times. During a security incident, EBS snapshots of suspicious instances are shared to a forensics account for analysis. A security engineer attempting to share a suspicious EBS snapshot to the forensics account receives the following error: `Unable to share snapshot. An error occurred (OperationNotPermitted) when calling the ModifySnapshotAttribute operation: Encrypted snapshots with EBS default key cannot be shared` Which combination of steps should the security engineer take in the incident account to complete the sharing operation? (Choose three.)

   • ACreate a customer managed CMK. Copy the EBS snapshot encrypting the destination snapshot using the new CMK.
   • BAllow forensics accounting principals to use the CMK by modifying its policy.
   • CCreate an Amazon EC2 instance. Attach the encrypted and suspicious EBS volume. Copy data from the suspicious volume to an unencrypted volume. Snapshot the unencrypted volume.
   • DCopy the EBS snapshot to the new decrypted snapshot.
   • ERestore a volume from the suspicious EBS snapshot. Create an unencrypted EBS volume of the same size.
   • FShare the target EBS snapshot with the forensics account.

   Show answer

   Answer: ABF

   Next question

4. Question 504 · 732 in bank

   A security engineer must use AWS Key Management Service (AWS KMS) to design a key management solution for a set of Amazon Elastic Block Store (Amazon EBS) volumes that contain sensitive data. The solution needs to ensure that the key material automatically expires in 90 days. Which solution meets these criteria?

   • AA customer managed key that uses customer provided key material
   • BA customer managed key that uses AWS provided key material
   • CAn AWS managed key
   • DOperating system encryption that uses GnuPG

   Show answer

   Answer: A

   Explanation

   You may set an expiration period for an imported key. AWS KMS will automatically delete the key material after the expiration period. You can also delete imported key material on demand. In both cases the key material itself is deleted but the KMS key reference in AWS KMS and associated metadata are retained so that the key material can be re-imported in the future. Keys generated by AWS KMS do not have an expiration time and cannot be deleted immediately; there is a mandatory 7 to 30 day wait period. All customer managed KMS keys, regardless of whether the key material was imported, can be manually disabled or scheduled for deletion. In this case the KMS key itself is deleted, not just the underlying key material. https://aws.amazon.com/kms/faqs/

   Source: Adapted from community discussion — rahav

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 505 · 732 in bank

   A company plans to create individual child accounts within an existing organization in AWS Organizations for each of its DevOps teams. AWS CloudTrail has been enabled and configured on all accounts to write audit logs to an Amazon S3 bucket in a centralized AWS account. A security engineer needs to ensure that DevOps team members are unable to modify or disable this configuration. How can the security engineers meet these requirements?

   • ACreate an IAM policy that prohibits changes to the specific CloudTrail trail and apply the policy to the AWS account root user.
   • BCreate an S3 bucket policy in the specified destination account for the CloudTrail trail that prohibits configuration changes from the AWS account root user in the source account.
   • CCreate an SCP that prohibits changes to the specific CloudTrail trail and apply the SCP to the appropriate organizational unit or account in Organizations.
   • DCreate an IAM policy that prohibits changes to the specific CloudTrail trail and apply to a new IAM group. Have team members use individual IAM accounts that are members of the new IAM group.

   Show answer

   Answer: C

   Next question

6. Question 506 · 732 in bank

   Select 2

   A company uses SAML federation to grant users access to AWS accounts. A company workload that is in an isolated AWS account runs on immutable infrastructure with no human access to Amazon EC2. The company requires a specialized user known as a break glass user to have access to the workload AWS account and instances in the case of SAML errors. A recent audit discovered that the company did not create the break glass user for the AWS account that contains the workload. The company must create the break glass user. The company must log any activities of the break glass user and send the logs to a security team. Which combination of solutions will meet these requirements? (Choose two.)

   • ACreate a local individual break glass IAM user for the security team. Create a trail in AWS CloudTrail that has Amazon CloudWatch Logs turned on. Use Amazon EventBridge to monitor local user activities.
   • BCreate a break glass EC2 key pair for the AWS account. Provide the key pair to the security team. Use AWS CloudTrail to monitor key pair activity. Send notifications to the security team by using Amazon Simple Notification Service (Amazon SNS).
   • CCreate a break glass IAM role for the account. Allow security team members to perform the AssumeRoleWithSAML operation. Create an AWS CloudTrail trail that has Amazon CloudWatch Logs turned on. Use Amazon EventBridge to monitor security team activities.
   • DCreate a local individual break glass IAM user on the operating system level of each workload instance. Configure unrestricted security groups on the instances to grant access to the break glass IAM users.
   • EConfigure AWS Systems Manager Session Manager for Amazon EC2. Configure an AWS CloudTrail filter based on Session Manager. Send the results to an Amazon Simple Notification Service (Amazon SNS) topic.

   Show answer

   Answer: AE

   Explanation

   A and E "Although the use and creation of AWS IAM users is highly discouraged, break glass users are an exception. To ensure human break-glass access to your environment, we recommend that you create the following in your AWS organization: At least two IAM users..." https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/break-glass-access.html

   Source: Adapted from community discussion — kejam

   References

   • AWS documentation

   Next question

7. Question 507 · 732 in bank

   Select 2

   A company has an IAM group. All of the IAM users in the group have been assigned a multi-factor authentication (MFA) device and have full access to Amazon S3. The company needs to ensure that users in the group can perform S3 actions only after the users authenticate with MFA. A security engineer must design a solution that accomplishes this goal with the least maintenance overhead. Which combination of actions will meet these requirements? (Choose two.)

   • AAdd a customer managed Deny policy to users in the group for s3:*actions.
   • BAdd a customer managed Deny policy to the group for s3:*actions.
   • CAdd a customer managed Allow policy to the group for s3:*actions.
   • DAdd a condition to the policy: ג€Conditionג€ : { ג€BoolIfExistsג€ : { ג€aws:MultiFactorAuthPresentג€ : false } }
   • EAdd a condition to the policy: ג€Conditionג€ : { ג€Boolג€ : { ג€aws:MultiFactorAuthPresentג€ : false } }

   Show answer

   Answer: BD

   Next question

8. Question 508 · 732 in bank

   Select 3

   A security engineer is working with a product team building a web application on AWS. The application uses Amazon S3 to host the static content, Amazon API Gateway to provide RESTful services, and Amazon DynamoDB as the backend data store. The users already exist in a directory that is exposed through a SAML identity provider. Which combination of the following actions should the engineer take to allow users to be authenticated into the web application and call APIs? (Choose three.)

   • ACreate a custom authorization service using AWS Lambda.
   • BConfigure a SAML identity provider in Amazon Cognito to map attributes to the Amazon Cognito user pool attributes.
   • CConfigure the SAML identity provider to add the Amazon Cognito user pool as a relying party.
   • DConfigure an Amazon Cognito identity pool to integrate with social login providers.
   • EUpdate DynamoDB to store the user email addresses and passwords.
   • FUpdate API Gateway to use a COGNITO_USER_POOLS authorizer.

   Show answer

   Answer: BCF

   Explanation

   For API to refer to Cognito user pool, use "COGNITO_USER_POOLS" authorizer https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enable-cognito-user-pool.html For Cognito user pool to act as relying party to SAML IdP https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp.html Other options: A- "As an alternative to using IAM roles and policies or Lambda authorizers (formerly known as custom authorizers), you can use an Amazon Cognito user pool to control who can access your API in Amazon API Gateway." https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html D - social login users not required for this question. E - Dynamo DB is irrelevant- never store store password in db without all the additional overheads required to keep them secure.

   Source: Adapted from community discussion — Daniel76

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 509 · 732 in bank

   A company is running workloads on AWS. The workloads are in separate AWS accounts for development, testing, and production. All the company’s developers can access the development account. A subset of the developers can access the testing account and the production account. The company is spending too much time managing individual credentials for every developer across every environment. A security engineer must implement a more scalable solution that the company can use when a developer needs different access. The solution must allow developers to access resources across multiple accounts. The solution also must minimize credential sharing. Which solution will meet these requirements?

   • AUse AWS Identity and Access Management Access Analyzer to identify the permissions that the developers need on each account. Configure IAM Access Analyzer to automatically provision the correct access for each developer.
   • BCreate an Amazon Simple Workflow Service (Amazon SWF) workflow. Instruct the developers to use the workflow to request access to other accounts when additional access is necessary.
   • CCreate IAM roles in the testing account and production account. Add a policy that allows the sts:AssumeRole action to the roles. Create IAM roles in the development account for the developers who have access to the testing and production accounts. Add these roles to the trust policy on the new roles in the testing and production accounts.
   • DCreate service accounts in the testing environment and production environment. Give the access keys for the service accounts to developers who require access to the testing account and the production account. Rotate the access keys for the service accounts periodically.

   Show answer

   Answer: C

   Next question

10. Question 510 · 732 in bank

    Select 3

    A company needs to improve its ability to identify and prevent IAM policies that grant public access or cross-account access to resources. The company has implemented AWS Organizations and has started using AWS Identity and Access Management Access Analyzer to refine overly broad access to accounts in the organization. A security engineer must automate a response in the company's organization for any newly created policies that are overly permissive. The automation must remediate external access and must notify the company's security team. Which combination of steps should the security engineer take to meet these requirements? (Choose three.)

    • ACreate an AWS Step Functions state machine that checks the resource type in the finding and adds an explicit Deny statement in the trust policy for the IAM role. Configure the state machine to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic.
    • BCreate an AWS Batch job that forwards any resource type findings to an AWS Lambda function. Configure the Lambda function to add an explicit Deny statement in the trust policy for the IAM role. Configure the AWS Batch job to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic.
    • CIn Amazon EventBridge, create an event rule that matches active IAM Access Analyzer findings and invokes AWS Step Functions for resolution.
    • DIn Amazon CloudWatch, create a metric filter that matches active IAM Access Analyzer findings and invokes AWS Batch for resolution.
    • ECreate an Amazon Simple Queue Service (Amazon SQS) queue. Configure the queue to forward a notification to the security team that an external principal has been granted access to the specific IAM role and has been blocked.
    • FCreate an Amazon Simple Notification Service (Amazon SNS) topic for external or cross-account access notices. Subscribe the security team's email addresses to the topic.

    Show answer

    Answer: ACF

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 501. 732 questions available.