SCS-C02 practice questions 591–600

1. Question 591 · 732 in bank

   A company does not allow the permanent installation of SSH keys onto an Amazon Linux 2 EC2 instance. However, three employees who have IAM user accounts require access to the EC2 instance. The employees must use an SSH session to perform critical duties. How can a security engineer provide the appropriate access to the EC2 instance to meet these requirements?

   • AUse AWS Systems Manager Inventory to select the EC2 instance and connect. Provide the IAM user accounts with the permissions to use Systems Manager Inventory.
   • BUse AWS Systems Manager Run Command to open an SSH connection to the EC2 instance. Provide the IAM user accounts with the permissions to use Run Command.
   • CUse AWS Systems Manager Session Manager. Provide the IAM user accounts with the permissions to use Systems Manager Session Manager.
   • DConnect to the EC2 instance as the ec2-user through the AWS Management Console’s EC2 SSH client method. Provide the IAM user accounts with access to use the EC2 service in the AWS Management Console.

   Show answer

   Answer: C

   Next question

2. Question 592 · 732 in bank

   A company is running a dynamic website by using an Application Load Balancer (ALB). A security engineer notices that bots from different IP addresses are using brute-force attacks to invoke a service endpoint frequently. What is the FASTEST way to mitigate this problem?

   • ACreate an AWS Lambda function to process ALB logs. Block the bots’ IP addresses in the ALB’s security group.
   • BCreate an AWS WAF web ACL for the ALAdd a rate-based rule to the web ACL to block the bots.
   • CCreate an ALB listener rule. Combine source-ip and path-pattern as the conditions to match bots. Specify a fixed-response action to return an HTTP 403 status.
   • DCreate an AWS WAF web ACL for the ALB. Add a rate-based rule to a rule group to block the bots. Attach the rule to the web ACL.

   Show answer

   Answer: D

   Next question

3. Question 593 · 732 in bank

   A company requires deep packet inspection on encrypted traffic to its web servers in its VPC. Which solution will meet this requirement?

   • ADecrypt traffic by using an Application Load Balancer (ALB) that is configured for TLS termination. Configure the ALB to send the traffic to an AWS Network Firewall endpoint for the deep packet inspection.
   • BDecrypt traffic by using a Network Load Balancer (NLB) that is configured for TLS termination. Configure the NLB to send the traffic to an AWS Network Firewall endpoint for the deep packet inspection.
   • CDecrypt traffic by using an Application Load Balancer (ALB) that is configured for TLS termination. Configure the ALB to send the traffic to an AWS WAF endpoint for the deep packet inspection.
   • DDecrypt traffic by using a Network Load Balancer (NLB) that is configured for TLS termination. Configure the NLB to send the traffic to an AWS WAF endpoint for the deep packet inspection.

   Show answer

   Answer: B

   Next question

4. Question 594 · 732 in bank

   A security team is working on a solution that will use Amazon EventBridge (Amazon CloudWatch Events) to monitor new Amazon S3 objects. The solution will monitor for public access and for changes to any S3 bucket policy or setting that result in public access. The security team configures EventBridge to watch for specific API calls that are logged from AWS CloudTrail. EventBridge has an action to send an email notification through Amazon Simple Notification Service (Amazon SNS) to the security team immediately with details of the API call. Specifically, the security team wants EventBridge to watch for the s3:PutObjectAcl, s3:DeleteBucketPolicy, and s3:PutBucketPolicy API invocation logs from CloudTrail. While developing the solution in a single account, the security team discovers that the s3:PutObjectAcl API call does not invoke an EventBridge event. However, the s3:DeleteBucketPolicy API call and the s3:PutBucketPolicy API call do invoke an event. The security team has enabled CloudTrail for AWS management events with a basic configuration in the AWS Region in which EventBridge is being tested. Verification of the EventBridge event pattern indicates that the pattern is set up correctly. The security team must implement a solution so that the s3:PutObjectAcl API call will invoke an EventBridge event. The solution must not generate false notifications. Which solution will meet these requirements?

   • AModify the EventBridge event pattern by selecting Amazon S3. Select All Events as the event type.
   • BModify the EventBridge event pattern by selecting Amazon S3. Select Bucket Level Operations as the event type.
   • CEnable CloudTrail Insights to identify unusual API activity.
   • DEnable CloudTrail to monitor data events for read and write operations to S3 buckets.

   Show answer

   Answer: D

   Next question

5. Question 595 · 732 in bank

   A company is running batch workloads that use containers on Amazon Elastic Container Service (Amazon ECS). The company needs a secure solution for storing API keys that are required for integration with external services. The company's security policy states that API keys must not be stored or transmitted in plaintext. The company's IT team currently rotates the API keys manually. A security engineer must recommend a solution that meets the security requirements and automates the rotation of the API keys Which solution should the security engineer recommend?

   • AUse a secure string parameter in AWS Systems Manager Parameter Store. Activate the feature for automatic rotation.
   • BUse Amazon EC2 user data for storing the API keys. Set up a scheduled AWS Lambda function to automatically rotate the API keys.
   • CUse AWS Fargate to store the API keys. Set up a scheduled AWS Lambda function to automatically rotate the API keys.
   • DUse AWS Secrets Manager to store the API keys. Reference the API keys in the container definition.

   Show answer

   Answer: D

   Next question

6. Question 596 · 732 in bank

   A company deploys a set of standard IAM roles in AWS accounts. The IAM roles are based on job functions within the company. To balance operational efficiency and security, a security engineer implemented AWS Organizations SCPs to restrict access to critical security services in all company accounts. All of the company's accounts and OUs within AWS Organizations have a default FullAWSAccess SCP that is attached. The security engineer needs to ensure that no one can disable Amazon GuardDuty and AWS Security Hub. The security engineer also must not override other permissions that are granted by IAM policies that are defined in the accounts. Which SCP should the security engineer attach to the root of the organization to meet these requirements?

   • A//IMG//
   • B//IMG//
   • C//IMG//
   • D//IMG//

   Show answer

   Answer: A

   Next question

7. Question 597 · 732 in bank

   A security engineer is creating a new Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster. The cluster will act as a data warehouse. A separate fleet of application servers will extract records from the data warehouse and will transform these records into reports that will be uploaded to Amazon S3 buckets. The security engineer must securely configure the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster so that only the application servers can access it. Which solution meets these requirements?

   • AConfigure network ACLs on the subnets that host the Amazon OpenSearch Service (Amazon Elasticsearch Service) instances to allow access from the application servers only.
   • BConfigure a VPC peering connection between the VPC that contains the application servers and the VPC that contains the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster.
   • CMonitor the VPC flow logs for traffic that is destined for the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster. Use the flow logs to detect traffic that did not originate from the application servers.
   • DConfigure the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster for VPC access only. Use a security group to allow access to the Amazon OpenSearch Service (Amazon Elasticsearch Service) cluster from the application servers only.

   Show answer

   Answer: D

   Next question

8. Question 598 · 732 in bank

   A company has implemented centralized logging and monitoring of AWS CloudTrail logs from all Regions in an Amazon S3 bucket. The log files are encrypted using AWS KMS. A security engineer is attempting to review the log files using a third-party tool hosted on an Amazon EC2 instance. The security engineer is unable to access the logs in the S3 bucket and receives an access denied error message. What should the security engineer do to fix this issue?

   • ACheck that the role the security engineer uses grants permission to decrypt objects using the KMS CMK.
   • BCheck that the role the security engineer uses grants permission to decrypt objects using the KMS CMK and gives access to the S3 bucket and objects.
   • CCheck that the role the EC2 instance profile uses grants permission to decrypt objects using the KMS CMK and gives access to the S3 bucket and objects.
   • DCheck that the role the EC2 instance profile uses grants permission to decrypt objects using the KMS CMK.

   Show answer

   Answer: C

   Next question

9. Question 599 · 732 in bank

   A company needs a cloud-based, managed desktop solution for its workforce of remote employees. The company wants to ensure that the employees can access the desktops only by using company-provided devices. A security engineer must design a solution that will minimize cost and management overhead. Which solution will meet these requirements?

   • ADeploy a custom virtual desktop infrastructure (VDI) solution with a restriction policy to allow access only from corporate devices.
   • BDeploy a fleet of Amazon EC2 instances. Assign an instance to each employee with certificate-based device authentication that uses Windows Active Directory.
   • CDeploy Amazon WorkSpaces. Set up a trusted device policy with IP blocking on the authentication gateway by using AWS Identity and Access Management (IAM).
   • DDeploy Amazon WorkSpaces. Create client certificates, and deploy them to trusted devices. Enable restricted access at the directory level.

   Show answer

   Answer: D

   Next question

10. Question 600 · 732 in bank

    A security engineer logs in to the AWS Lambda console with administrator permissions. The security engineer is trying to view logs in Amazon CloudWatch for a Lambda function that is named my Function. When the security engineer chooses the option in the Lambda console to view logs in CloudWatch, an “error loading Log Streams" message appears. The IAM policy for the Lambda function's execution role contains the following:

    

    How should the security engineer correct the error?

    • AMove the logs:CreateLogGroup action to the second Allow statement.
    • BAdd the logs:PutDestination action to the second Allow statement.
    • CAdd the logs:GetLogEvents action to the second Allow statement.
    • DAdd the logs:CreateLogStream action to the second Allow statement.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 591. 732 questions available.