SCS-C02 practice questions 551–560

1. Question 551 · 732 in bank

   A company runs workloads on Amazon EC2 instances in VPCs. The EC2 instances make requests to Amazon S3 buckets through VPC endpoints. The company uses AWS Organizations to manage its AWS accounts. The company needs the requests from the EC2 instances to originate from the same VPC that the EC2 instance credentials were issued to. Which solution will meet this requirement?

   • ADeploy an SCP that includes the S3:* action with the “aws:SourceVpc”: “${aws:Ec2InstanceSourceVpc}” condition.
   • BEdit the VPC endpoints to include the S3:* action with the “aws:Ec2InstanceSourcePrivateIPv4”: “${aws:VpcSourceIp}” condition.
   • CLimit all actions in the S3 bucket policies by using the aws:SourceVpce condition key with the value of the allowed VPC endpoint.
   • DLimit all actions in the S3 bucket policies by using the aws:SourceVpc condition key with the value of the allowed VPC ID.

   Show answer

   Answer: D

   Next question

2. Question 552 · 732 in bank

   A company's application team needs to host a MySQL database on AWS. According to the company's security policy, all data that is stored on AWS must be encrypted at rest. In addition, all cryptographic material must be compliant with FIPS 140-2 Level 3 validation. The application team needs a solution that satisfies the company's security requirements and minimizes operational overhead. Which solution will meet these requirements?

   • AHost the database on Amazon RDS. Use Amazon Elastic Block Store (Amazon EBS) for encryption. Use an AWS Key Management Service (AWS KMS) custom key store that is backed by AWS CloudHSM for key management.
   • BHost the database on Amazon RDS. Use Amazon Elastic Block Store (Amazon EBS) for encryption. Use an AWS managed CMK in AWS Key Management Service (AWS KMS) for key management.
   • CHost the database on an Amazon EC2 instance. Use Amazon Elastic Block Store (Amazon EBS) for encryption. Use a customer managed CMK in AWS Key Management Service (AWS KMS) for key management.
   • DHost the database on an Amazon EC2 instance. Use Transparent Data Encryption (TDE) for encryption and key management.

   Show answer

   Answer: A

   Next question

3. Question 553 · 732 in bank

   A company uses Amazon Cognito for external user authentication for a web application. External users report that they can no longer log in to the application. What is the FIRST step that a security engineer should take to troubleshoot the problem?

   • AReview AWS CloudTrail logs to identify authentication errors that relate to Cognito users.
   • BUse AWS Identity and Access Management Access Analyzer to delete all unused IAM roles and users.
   • CReview any recent changes in Cognito configuration, IAM policies, and role trust policies to identify issues.
   • DWrite a script that uses CLI commands to reset all user passwords in the Cognito user pool.

   Show answer

   Answer: C

   Next question

4. Question 554 · 732 in bank

   Select 3

   A company is operating a website using Amazon CloudFront. CloudFront serves some content from Amazon S3 and other content from web servers running on Amazon EC2 instances behind an Application Load Balancer (ALB). Amazon DynamoDB is used as the data store. The company already uses AWS Certificate Manager (ACM) to store a public TLS certificate that can optionally secure connections between the website users and CloudFront. The company has a new requirement to enforce end-to-end encryption in transit. Which combination of steps should the company take to meet this requirement? (Choose three.)

   • AUpdate the CloudFront distribution, configuring it to optionally use HTTPS when connecting to origins on Amazon S3.
   • BUpdate the web application configuration on the web servers to use HTTPS instead of HTTPS when connecting to DynamoDB.
   • CUpdate the CloudFront distribution to redirect HTTP connections to HTTPS.
   • DConfigure the web servers on the EC2 instances to listen using HTTPS using the public ACM TLS certificate. Update the ALB to connect to the target group using HTTPS.
   • EUpdate the ALB listener to listen using HTTPS using the public ACM TLS certificate. Update the CloudFront distribution to connect to the HTTPS listener.
   • FCreate a TLS certificate. Configure the web servers on the EC2 instances to use HTTPS only with that certificate. Update the ALB to connect to the target group using HTTPS.

   Show answer

   Answer: CEF

   Next question

5. Question 555 · 732 in bank

   Select 2

   A company is running its application on AWS. Malicious users exploited a recent promotion event and created many fake accounts. The application currently uses Amazon CloudFront in front of an Amazon API Gateway API. AWS Lambda functions serve the different API endpoints. The GET registration endpoint is behind the path of /store/registration. The URI for submission of the new account details is at /store/newaccount. A security engineer needs to design a solution that prevents similar exploitations for future promotion events. Which combination of steps will meet these requirements? (Choose two.)

   • ACreate an AWS WAF web ACL. Add the AWSManagedRulesACFPRuleSet rule group to the web ACL. Associate the web ACL with the CloudFront distribution.
   • BCreate an AWS WAF web ACL. Add a rate limit rule to the web ACL. Include a RateBasedStatement entry that has a SearchString value that points to /store/registration.
   • CSpecify /store/registration as the registration page path. Specify /store/newaccount as the account creation path.
   • DEnable AWS Shield Advanced for the account that hosts the CloudFront distribution. Configure a DNS-specific custom mitigation that uses the Shield Response Team (SRT) for /store/newaccount.
   • EEnable Amazon GuardDuty for the account that hosts the CloudFront distribution. Enable Lambda Protection for the Lambda functions that answer calls to /store/registration and /store/newaccount.

   Show answer

   Answer: AB

   Next question

6. Question 556 · 732 in bank

   A company has a new AWS account that does not have AWS CloudTrail configured. The account has an IAM access key that was issued by AWS Security Token Service (AWS STS). A security engineer discovers that the IAM access key has been compromised within the last 24 hours. The security engineer must stop the compromised IAM access key from being used. The security engineer also must determine which activities the key has been used for so far. What should the security engineer do to meet these requirements?

   • AIn the CloudTrail console, under CloudTrail event history, search by access key for the compromised key, with the correlated events, and identify which IAM user the key belongs to. In the IAM console, revoke all active sessions for that IAM user.
   • BCreate a new CloudTrail trail. In the CloudTrail console, under CloudTrail event history, search by access key for the compromised key, view the correlated events, and identify which IAM user the key belongs to. In the IAM console, revoke all active sessions for that IAM user.
   • CCreate a new CloudTrail trail. In the CloudTrail console, under CloudTrail event history, search by access key for the compromised key, view the correlated events, and identify which IAM role the key belongs to. In the IAM console, delete that IAM role.
   • DIn the CloudTrail console, under CloudTrail event history, search by access key for the compromised key, view the correlated events, and identify which IAM role the key belongs to. In the IAM console, revoke all active sessions for that IAM role.

   Show answer

   Answer: D

   Next question

7. Question 557 · 732 in bank

   A company is investigating an increase in its AWS monthly bill. The company discovers that bad actors compromised some Amazon EC2 instances and served webpages for a large email phishing campaign. A security engineer must implement a solution to monitor for cost increases in the future to help detect malicious activity. Which solution will offer the company the EARLIEST detection of cost increases?

   • ACreate an Amazon EventBridge rule that invokes an AWS Lambda function hourly. Program the Lambda function to download an AWS usage report from AWS Data Exports about usage of all services. Program the Lambda function to analyze the report and to send a notification when anomalies are detected.
   • BCreate a cost monitor in AWS Cost Anomaly Detection. Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage above the expected cost exceeds a threshold.
   • CReview AWS Cost Explorer daily to detect anomalies in cost from prior months. Review the usage of any services that experience a significant cost increase from prior months.
   • DCapture VPC flow logs from the VPC where the EC2 instances run. Use a third-party network analysis tool to analyze the flow logs and to detect anomalies in network traffic that might increase cost.

   Show answer

   Answer: B

   Next question

8. Question 558 · 732 in bank

   A company has a website with an Amazon CloudFront HTTPS distribution an Application Load Balancer (ALB) with multiple web instances for dynamic website content, and an Amazon S3 bucket for static website content. The company's security engineer recently updated the website security requirements: ✑ HTTPS needs to be enforced for all data in transit with specific ciphers. ✑ The CloudFront distribution needs to be accessible from the internet only. Which solution will meet these requirements?

   • ASet up an S3 bucket policy with the aws:securetransport key. Configure the CloudFront origin access identity (OAI) with the S3 bucket. Configure CloudFront to use specific ciphers. Enforce the ALB with an HTTPS listener only and select the appropriate security policy for the ciphers. Link the ALB with AWS WAF to allow access from the CloudFront IP ranges.
   • BSet up an S3 bucket policy with the aws:securetransport key. Configure the CloudFront origin access identity (OAI) with the S3 bucket. Enforce the ALB with an HTTPS listener only and select the appropriate security policy for the ciphers.
   • CModify the CloudFront distribution to use AWS WAF. Force HTTPS on the S3 bucket with specific ciphers in the bucket policy. Configure an HTTPS listener only for the ALB. Set up a security group to limit access to the ALB from the CloudFront IP ranges.
   • DModify the CloudFront distribution to use the ALB as the origin. Enforce an HTTP listener on the ALB. Create a path-based routing rule on the ALB with proxies that connect to Amazon S3. Create a bucket policy to allow access from these proxies only.

   Show answer

   Answer: A

   Next question

9. Question 559 · 732 in bank

   A company’s network security policy requires encryption for all data in transit. The company must encrypt data that is sent between Amazon EC2 instances and Amazon Elastic Block Store (Amazon EBS) volumes. Which solution will meet this requirement?

   • AConfigure Amazon EC2 to enable encryption in the EC2 network interface properties.
   • BConfigure Amazon EBS to enable volume encryption with AWS Key Management Service (AWS KMS) for data at rest.
   • CConfigure Amazon EBS to enable TLS encryption in the volume configuration properties.
   • DConfigure Amazon EC2 to enable TLS encryption with certificates that are stored in AWS Certificate Manager (ACM).

   Show answer

   Answer: D

   Next question

10. Question 560 · 732 in bank

    A company hosts a web-based application that captures and stores sensitive data in an Amazon DynamoDB table. A security audit reveals that the application does not provide end-to-end data protection or the ability to detect unauthorized data changes. The software engineering team needs to make changes that will address the audit findings. Which set of steps should the software engineering team take?

    • AUse an AWS Key Management Service (AWS CMK) CMK. Encrypt the data at rest.
    • BUse AWS Certificate Manager (ACM) Private Certificate Authority. Encrypt the data in transit.
    • CUse a DynamoDB encryption client. Use client-side encryption and sign the table items.
    • DUse the AWS Encryption SDK. Use client-side encryption and sign the table items.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 551. 732 questions available.