SCS-C02 practice questions 621–630

1. Question 621 · 732 in bank

   Select 2

   A security engineer is attempting to troubleshoot a problem. An application that runs on an Amazon EC2 instance in a VPC cannot communicate with an Amazon RDS DB instance in another subnet of the same VPC. The connection request is timing out. Which issues could be causing this problem? (Choose two.)

   • AThe application instance’s security group is not allowing outbound traffic.
   • BThe network ACL of the application instance’s subnet is not allowing traffic between the application and the DB instance.
   • CThe VPC’s route table is not configured correctly.
   • DThere is no peering connection between the application and the database.
   • EThe DB instance’s security group is not allowing outbound traffic.

   Show answer

   Answer: AB

   Next question

2. Question 622 · 732 in bank

   A company operates a web application that runs on Amazon EC2 instances. The application listens on port 80 and port 443. The company uses an Application Load Balancer (ALB) with AWS WAF to terminate SSL and to forward traffic to the application instances only on port 80. The ALB is in public subnets that are associated with a network ACL that is named NACL. The application instances are in dedicated private subnets that are associated with a network ACL that is named NACL2. An Amazon RDS for PostgreSQL DB instance that uses port 5432 is in a dedicated private subnet that is associated with a network ACL that is named NACL3. All the network ACLs currently allow all inbound and outbound traffic. Which set of network ACL changes will increase the security of the application while ensuring functionality?

   • AMake the following changes to NACL3: Add a rule that allows inbound traffic on port 5432 from NACL2. Add a rule that allows outbound traffic on ports 1024-65536 to NACL2. Remove the default rules that allow all inbound and outbound traffic.
   • BMake the following changes to NACL3: Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the application instance subnets. Add a rule that allows outbound traffic on ports 1024-65536 to the application instance subnets. Remove the default rules that allow all inbound and outbound traffic.
   • CMake the following changes to NACL2: Add a rule that allows outbound traffic on port 5432 to the CIDR blocks of the RDS subnets. Remove the default rules that allow all inbound and outbound traffic.
   • DMake the following changes to NACL2: Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the RDS subnets. Add a rule that allows outbound traffic on port 5432 to the RDS subnets.

   Show answer

   Answer: B

   Next question

3. Question 623 · 732 in bank

   Select 2

   A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. The security engineer has provisioned each Availability Zone with one private subnet and one public subnet. The security engineer has created three route tables for use with the environment. One route table is for the public subnets, and two route tables are for the private subnets (one route table for the private subnet in each Availability Zone). The security engineer discovers that all four subnets are attempting to route traffic out though the internet gateway that is attached to the VPC. Which combination of steps should the security engineer take to remediate this scenario? (Choose two.)

   • AVerify that a NAT gateway has been provisioned in the public subnet in each Availability Zone.
   • BVerify that a NAT gateway has been provisioned in the private subnet in each Availability Zone.
   • CModify the route tables that are associated with each of the public subnets. Create a new route for local destinations to the VPC CIDR range.
   • DModify the route tables that are associated with each of the private subnets. Create a new route for the destination 0.0.0.0/0. Specify the NAT gateway in the public subnet of the same Availability Zone as the target of the route
   • EModify the route tables that ae associated with each of the private subnets. Create a new route for the destination 0.0.0.0/0. Specify the internet gateway in the public subnet of the same Availability Zone as the target of the route.

   Show answer

   Answer: AD

   Next question

4. Question 624 · 732 in bank

   A company has decided to use AWS Key Management Service (AWS KMS) for all of its encryption keys. The company plans to create all of its keys as customer managed CMKs and will not import any encryption keys. The company must rotate its encryption keys once every 12 months. Which solution will meet these requirements?

   • AChange the customer managed CMK key policy to enable automatic key rotation.
   • BUse AWS managed CMKs instead of customer managed CMKs so that AWS will rotate the keys automatically.
   • CInvoke an AWS Lambda function regularly to rotate the backing key of each customer managed CMK.
   • DEnable automatic key rotation for each customer managed CMK after it has been created in AWS KMS.

   Show answer

   Answer: D

   Next question

5. Question 625 · 732 in bank

   A security engineer needs to implement a solution to create and control the keys that a company uses for cryptographic operations. The security engineer must create symmetric keys in which the key material is generated and used within a custom key store that is backed by an AWS CloudHSM cluster. The security engineer will use symmetric and asymmetric data key pairs for local use within applications. The security engineer also must audit the use of the keys. How can the security engineer meet these requirements?

   • ATo create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon Athena.
   • BTo create the keys, use Amazon S3 and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.
   • CTo create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon GuardDuty.
   • DTo create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.

   Show answer

   Answer: D

   Next question

6. Question 626 · 732 in bank

   Select 2

   A company is testing a new version of its application. The company is using a public Amazon API Gateway API to expose the application. Currently, the company wants to allow only testers from its network to access the new application. Which solutions can the company use to meet these requirements? (Choose two.)

   • ACreate and configure a security group that allows access from the company’s IP address range. Apply the security group to the API Gateway API.
   • BCreate and configure a network ACL that allows traffic from the company’s IP address range. Apply the network ACL to the API Gateway API subnet.
   • CCreate an AWS WAF web ACL. Configure an IP match rule that allows traffic from the company’s IP address range. Apply the web ACL to the API Gateway API.
   • DUse a condition in the API Gateway resource policy to allow access only from the company’s IP address range.
   • ECreate an interface VPC endpoint for the API Gateway execute-api. Instruct testers to use this endpoint.

   Show answer

   Answer: CD

   Next question

7. Question 627 · 732 in bank

   A large company organizes hundreds of AWS accounts in AWS Organizations in Developer, Test, and Production OUs. Developers who have full administrative privileges in their respective accounts use the accounts in the Developer OU. The company wants to allow only certain Amazon EC2 instance types to be used within the Developer OU. How can the company prevent developer accounts from launching unapproved EC2 instance types?

   • ACreate a now launch template in each AWS account in the Developer OU to deny the ec2:RunInstances API call for instance types that are not in an approved list Associate these templates with all IAM principals in the account.
   • BCreate an IAM policy to deny the ec2:RunInstances API call for instance types that are not in an approved list. Attach the policy to all IAM principals in all the AWS accounts in the Developer OU.
   • CUse a managed SCP that is attached to the organization's root account to deny the ec2:RunInstances API call for instance types that are not in an approved list
   • DCreate an SCP to deny the ec2:RunInstances API call for instance types that are not in an approved list. Attach the policy to the Developer OU.

   Show answer

   Answer: D

   Next question

8. Question 628 · 732 in bank

   A security team is using Amazon EC2 Image Builder to build a hardened AMI with forensic capabilities. An AWS Key Management Service (AWS KMS) key will encrypt the forensic AMI. EC2 Image Builder successfully installs the required patches and packages in the security team’s AWS account. The security team uses a federated IAM role in the same AWS account to sign in to the AWS Management Console and attempts to launch the forensic AMI. The EC2 instance launches and immediately terminates. What should the security team do to launch the EC2 instance successfully?

   • AUpdate the policy that is associated with the federated IAM role to allow the ec2:DescribeImages action for the forensic AML.
   • BUpdate the policy that is associated with the federated IAM role to allow the ec2:StartInstances action in the security team's AWS account.
   • CUpdate the policy that is associated with the KMS key that is used to encrypt the forensic AMI. Configure the policy to allow the kms:Encrypt and kms:Decrypt actions for the federated IAM role.
   • DUpdate the policy that is associated with the federated IAM role to allow the kms:DescribeKey action for the KMS key that is used to encrypt the forensic AMI.

   Show answer

   Answer: C

   Next question

9. Question 629 · 732 in bank

   A company has identified two security concerns. One concern is unencrypted Amazon Elastic Block Store (Amazon EBS) volumes. The other concern is public IP addresses that are assigned to Amazon EC2 instances. A security engineer must build a solution to prevent and remediate these security issues. What should the security engineer do to meet these requirements with the LEAST amount of effort?

   • AUse AWS CloudTrail to monitor accounts for noncompliant configurations. Use AWS Lambda functions to evaluate configuration state and perform automated remediation actions.
   • BUse AWS Config rules to monitor accounts for noncompliant configurations. Use AWS Systems Manager Automation to perform automated remediation actions.
   • CUse Amazon GuardDuty to monitor accounts for noncompliant configurations. Use AWS Lambda function to perform automated remediation actions.
   • DUse AWS Systems Manager Compliance to monitor accounts for noncompliant configurations. Use Systems Manager Automation to perform automated remediation actions.

   Show answer

   Answer: B

   Next question

10. Question 630 · 732 in bank

    Select 2

    A company is designing a new application stack. The design includes web servers and backend servers that are hosted on Amazon EC2 instances. The design also includes an Amazon Aurora MySQL DB cluster. The EC2 instances are in an Auto Scaling group that uses launch templates. The EC2 instances for the web layer and the backend layer are backed by Amazon Elastic Block Store (Amazon EBS) volumes. No layers are encrypted at rest. A security engineer needs to implement encryption at rest. Which combination of steps will meet these requirements? (Choose two.)

    • AModify EBS default encryption setting in the target AWS Region to enable encryption. Use an Auto Scaling group instance refresh.
    • BModify the launch templates for the web layer and the backend layer to add AWS Certificate Manager (ACM) encryption for the attached EBS volumes. Use an Auto Scaling group instance refresh.
    • CCreate a new AWS Key Management Service (AWS KMS) encrypted DB cluster from a snapshot of the existing DB cluster.
    • DApply AWS Key Management Service (AWS KMS) encryption to the existing DB cluster.
    • EApply AWS Certificate Manager (ACM) encryption to the existing DB cluster.

    Show answer

    Answer: AC

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 621. 732 questions available.