SCS-C02 practice questions 651–660

1. Question 651 · 732 in bank

   A company wants to implement a content delivery network for an upcoming product launch. The origin for distribution is an object store outside of AWS and requires the Authorization header from the request to be passed to it. How can a security engineer meet this requirement in the LEAST amount of time?

   • AMigrate the objects to Amazon S3. Create a new AWS Global Accelerator accelerator that has a listener on port 443 and an endpoint group that points to the origin distribution.
   • BCreate a new Amazon CloudFront distribution. Create a new CloudFront custom header for X-Amz-Authorization. Attach the header to the distribution.
   • CCreate a new Amazon CloudFront distribution. Create a new CloudFront cache policy with a header whitelist for the Authorization header. Attach the policy to the distribution.
   • DMigrate the objects to Amazon S3. Create a new Amazon CloudFront distribution. Create a new CloudFront cache policy with a header whitelist for the Authorization header. Attach the policy to the distribution.

   Show answer

   Answer: C

   Next question

2. Question 652 · 732 in bank

   A company uses AWS Organizations. The company has teams that use an AWS CloudHSM hardware security module (HSM) that is hosted in a central AWS account. One of the teams creates its own new dedicated AWS account and wants to use the HSM that is hosted in the central account. How should a security engineer share the HSM that is hosted in the central account with the new dedicated account?

   • AUse AWS Resource Access Manager (AWS RAM) to share the VPC subnet ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the new dedicated account.
   • BUse AWS Identity and Access Management (IAM) to create a cross-account role to access the CloudHSM cluster that is in the central account. Create a new IAM user in the new dedicated account. Assign the cross-account role the new IAM user.
   • CUse AWS Single Sign-On to create an AWS Security Token Service (AWS STS) token to authenticate from the new dedicated account to the central account. Use the cross-account permissions that are assigned to the STS token to invoke an operation on the HSM in the central account.
   • DUse AWS Resource Access Manager (AWS RAM) to share the ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the new dedicated account.

   Show answer

   Answer: A

   Next question

3. Question 653 · 732 in bank

   A company recently began using Amazon Route 53 as its DNS provider. The company must log public DNS queries that Route 53 receives. The company has activated Route 53 public DNS query logging. The queries must be stored in a highly durable storage solution that deletes logs that are older than 1 year. Which solution will meet these requirements MOST cost-effectively?

   • AConfigure Route 53 to export log data to Amazon S3. Configure an S3 Lifecycle policy that deletes objects in the target S3 bucket that are older than 1 year.
   • BConfigure Route 53 to export log data to Amazon S3. Configure an AWS Lambda function to run every hour to delete log files that are older than 1 year.
   • CConfigure Route 53 to export log data to Amazon CloudWatch Logs. For the target CloudWatch Logs log group, set the retention period to 1 year.
   • DConfigure Route 53 to export log data to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to identify and delete log entries that are older than 1 year.

   Show answer

   Answer: A

   Next question

4. Question 654 · 732 in bank

   A company has configured a gateway VPC endpoint in a VPC. Only Amazon EC2 instances that reside in a single subnet in the VPC can use the endpoint. The company has modified the route table for this single subnet to route traffic to Amazon S3 through the gateway VPC endpoint. The VPC provides internet access through an internet gateway. A security engineer attempts to use instance profile credentials from an EC2 instance to retrieve an object from the S3 bucket, but the attempt fails. The security engineer verifies that the EC2 instance has an IAM instance profile with the correct permissions to access the S3 bucket and to retrieve objects. The security engineer also verifies that the S3 bucket policy is allowing access properly. Additionally, the security engineer verifies that the EC2 instance’s security group and the subnet’s network ACLs allow the communication. What else should the security engineer check to determine why the request from the EC2 instance is failing?

   • AVerify that the EC2 instance’s security group does not have an implicit inbound deny rule for Amazon S3.
   • BVerify that the VPC endpoint’s security group does not have an explicit inbound deny rule for the EC2 instance.
   • CVerify that the internet gateway is allowing traffic to Amazon S3.
   • DVerify that the VPC endpoint policy is allowing access to Amazon S3.

   Show answer

   Answer: D

   Next question

5. Question 655 · 732 in bank

   Select 3

   A company has a single AWS account and uses an Amazon EC2 instance to test application code. The company recently discovered that the instance was compromised. The instance was serving up malware. The analysis of the instance showed that the instance was compromised 35 days ago. A security engineer must implement a continuous monitoring solution that automatically notifies the company’s security team about compromised instances through an email distribution list for high severity findings. The security engineer must implement the solution as soon as possible. Which combination of steps should the security engineer take to meet these requirements? (Choose three.)

   • AEnable AWS Security Hub in the AWS account.
   • BEnable Amazon GuardDuty in the AWS account.
   • CCreate an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team’s email distribution list to the topic.
   • DCreate an Amazon Simple Queue Service (Amazon SQS) queue. Subscribe the security team’s email distribution list to the queue.
   • ECreate an Amazon EventBridge (Amazon CloudWatch Events) rule for GuardDuty findings of high severity. Configure the rule to publish a message to the topic.
   • FCreate an Amazon EventBridge (Amazon CloudWatch Events) rule for Security Hub findings of high severity. Configure the rule to publish a message to the queue.

   Show answer

   Answer: BCE

   Next question

6. Question 656 · 732 in bank

   A company is using AWS Organizations to create OUs for its accounts. The company has more than 20 accounts that are all part of the OUs. A security engineer must implement a solution to ensure that no account can stop log file delivery to AWS CloudTrail. Which solution will meet this requirement?

   • AUse the --is-multi-region-trail option while running the create-trail command to ensure that logs are configured across all AWS Regions.
   • BCreate an SCP that includes a Deny rule for the cloudtrail:StopLogging action. Apply the SCP to all accounts in the OUs.
   • CCreate an SCP that includes an Allow rule for the cloudtrail:StopLogging action. Apply the SCP to all accounts in the OUs.
   • DUse AWS Systems Manager to ensure that CloudTrail is always turned on.

   Show answer

   Answer: B

   Next question

7. Question 657 · 732 in bank

   Select 2

   A company has an AWS WAF web ACL. According to a new compliance requirement, the company must configure comprehensive logging of all web ACL requests. The company has created an Amazon S3 bucket to store the logs. Which combination of steps should the company take next to meet this requirement? (Choose two.)

   • AEnable logging for the web ACL. Associate the web ACL with the Amazon Kinesis data stream.
   • BEnable logging for the web ACL. Associate the web ACL with the Amazon Kinesis Data Firehose delivery stream.
   • CConfigure log filtering for the web ACL. Associate the web ACL with the Amazon Kinesis Data Firehose delivery stream.
   • DCreate an Amazon Kinesis data stream in any AWS Region. Specify the S3 bucket as the destination for the data stream.
   • ECreate an Amazon Kinesis Data Firehose delivery stream in the same AWS Region as the web ACL. Specify the S3 bucket as the destination for the delivery stream.

   Show answer

   Answer: BE

   Next question

8. Question 658 · 732 in bank

   A company has two VPCs in the us-east-1 Region: vpc-1 and vpe-2. The company recently created an Amazon API Gateway REST API with the endpoint type set to PRIVATE. The company also created a VPC endpoint for the REST API in vpc-1. Resources in vpc-1 can access the REST API successfully. The company now wants to give resources in vpc-2 the ability to access the REST API. The company creates a VPC endpoint for the REST API in vpc-2, but the resources in vpc-2 cannot access the REST API. A security engineer must make the REST API accessible to resources in vpc-2 by creating a solution that provides the minimum access that is necessary. Which solution will meet these requirements?

   • ASet up VPC peering between vpc-1 and vpc-2. Attach an identity-based policy to the resources in vpc-2 to grant access to the REST API.
   • BSet up a VPC endpoint of vpc-2 in vpc-1. Attach an identity-based policy to the resources in vpc-2 to grant access to the REST API.
   • CSet the API endpoint type to REGIONAL. Attach a resource policy to the REST API to allow access from vpc-2.
   • DKeep the API endpoint type as PRIVATE. Attach a resource policy to the REST API to allow access from vpc-2.

   Show answer

   Answer: D

   Next question

9. Question 659 · 732 in bank

   Select 2

   A company has application logs from AWS accounts in an organization in AWS Organizations. A security engineer is copying these logs to a centralized Amazon S3 bucket in the security team’s AWS account. Each of the company’s applications is in its own AWS account. Logs are encrypted and pushed into S3 buckets that are associated with each account. The security engineer deploys an AWS Lambda function into each account to copy the relevant log files to the centralized S3 bucket. The Lambda function can copy the log files in the centralized S3 bucket. The Lambda function’s IAM execution role policy from the security team’s AWS account is the following:

   

   The centralized S3 bucket policy is the following:

   

   The security engineer needs to remove excess permissions while ensuring the functionality of the solution. Which changes to the policies meet these requirements? (Choose two.)

   • AUpdate the centralized S3 bucket policy to the following: //IMG//
   • BUpdate the centralized S3 bucket policy to the following: //IMG//
   • CUpdate the Lambda IAM execution role policy to the following: //IMG//
   • DUpdate the Lambda IAM execution role policy to the following: //IMG//
   • EUpdate the Lambda IAM execution role policy to the following: //IMG//

   Show answer

   Answer: BD

   Next question

10. Question 660 · 732 in bank

    A company’s security team needs to receive a notification whenever an AWS access key has not been rotated in 90 or more days. A security engineer must develop a solution that provides these notifications automatically. Which solution will meet these requirements with the LEAST amount of effort?

    • ADeploy an AWS Config managed rule to run on a periodic basis of 24 hours. Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to 90 days. Create an Amazon EventBridge (Amazon CloudWatch Events) rule with an event pattern that matches the compliance type of NON_COMPLIANT from AWS Config for the managed rule. Configure EventBridge (CloudWatch Events) to send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
    • BCreate a script to export a .csv file from the AWS Trusted Advisor check for IAM access key rotation. Load the script into an AWS Lambda function that will upload the .csv file to an Amazon S3 bucket. Create an Amazon Athena table query that runs when the .csv file is uploaded to the S3 bucket. Publish the results for any keys older than 90 days by using an invocation of an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
    • CCreate a script to download the IAM credentials report on a periodic basis. Load the script into an AWS Lambda function that will run on a schedule through Amazon EventBridge (Amazon CloudWatch Events). Configure the Lambda script to load the report into memory and to filter the report for records in which the key was last rotated at least 90 days ago. If any records are detected, send an Amazon Simple Notification Service (Amazon SNS) notification to the security team.
    • DCreate an AWS Lambda function that queries the IAM API to list all the users. Iterate through the users by using the ListAccessKeys operation. Verify that the value in the CreateDate field is not at least 90 days old. Send an Amazon Simple Notification Service (Amazon SNS) notification to the security team if the value is at least 90 days old. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to schedule the Lambda function to run each day.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 651. 732 questions available.