SCS-C02 practice questions 661–670

1. Question 661 · 732 in bank

   A security engineer needs to create an Amazon S3 bucket policy that restricts access to specific IP address ranges. The policy must allow only IP addresses in the range 10.24.34.0/23 to access the S3 bucket DOC-EXAMPLE-BUCKET and its objects. The policy must deny access to DOC-EXAMPLE-BUCKET from other IP address ranges. IAM policies will control the actions that principals can take in the S3 bucket. Which policy meets these requirements?

   • A//IMG//
   • B//IMG//
   • C//IMG//
   • D//IMG//

   Show answer

   Answer: B

   Next question

2. Question 662 · 732 in bank

   Select 3

   A company’s security engineer receives an abuse notification from AWS. The notification indicates that someone is hosting malware from the company’s AWS account. After investigation, the security engineer finds a new Amazon S3 bucket that an IAM user created without authorization. Which combination of steps should the security engineer take to MINIMIZE the consequences of this compromise? (Choose three.)

   • AEncrypt all AWS CloudTrail logs.
   • BTurn on Amazon GuardDuty.
   • CChange the password for all IAM users.
   • DRotate or delete all AWS access keys.
   • ETake snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.
   • FDelete any resources that are unrecognized or unauthorized.

   Show answer

   Answer: CDF

   Next question

3. Question 663 · 732 in bank

   A company is running its workloads in a single AWS Region and uses AWS Organizations. A security engineer must implement a solution to prevent users from launching resources in other Regions. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate an IAM policy that has an aws:RequestedRegion condition that allows actions only in the designated Region. Attach the policy to all users.
   • BCreate an IAM policy that has an aws:RequestedRegion condition that denies actions that are not in the designated Region. Attach the policy to the AWS account in AWS Organizations.
   • CCreate an IAM policy that has an aws:RequestedRegion condition that allows the desired actions. Attach the policy only to the users who are in the designated Region.
   • DCreate an SCP that has an aws:RequestedRegion condition that denies actions that are not in the designated Region. Attach the SCP to the AWS account in AWS Organizations.

   Show answer

   Answer: D

   Next question

4. Question 664 · 732 in bank

   A security engineer needs to implement automation for AWS resources at scale. The goal is to block traffic to and from suspicious remote hosts by specifying IP addresses that are associated with known command and control servers for botnets. The security engineer is using AWS Step Functions to orchestrate the solution. What should the security engineer do to meet these requirements?

   • AUse Amazon GuardDuty to detect suspicious communication. Use an Amazon DynamoDB table to store IP addresses of suspected malicious hosts. Use AWS. Lambda functions to update the DynamoDB table and to update an AWS WAF web ACL rule to block the traffic.
   • BUse Amazon GuardDuty to detect suspicious communication. Use an Amazon DynamoDB table to store IP addresses of suspected malicious hosts. Use AWS Lambda functions to update the DynamoDB table and to update an AWS Network Firewall rule group to block the traffic.
   • CUse Amazon Inspector to detect suspicious communication. Use an Amazon DynamoDB table to store IP addresses of suspected malicious hosts. Use AWS Lambda functions to update the DynamoDB table and to update an AWS WAF web ACL rule to block the traffic.
   • DUse Traffic Mirroring. Direct the mirrored traffic to an Amazon EC2 instance that has the Amazon Inspector agent configured to search for suspicious communication. Use an Amazon DynamoDB table to store IP addresses of suspected malicious hosts. Use AWS Lambda functions to update the DynamoDB table and to update an AWS Network Firewall rule group to block the traffic.

   Show answer

   Answer: B

   Next question

5. Question 665 · 732 in bank

   A company is using AWS Systems Manager Session Manager to manage Amazon EC2 instances. A user is unable to connect to a new EC2 instance that runs Amazon Linux 2 in a private subnet in a newly created VPC. The user confirms that the new EC2 instance has the correct IAM instance profile attached. What is the MOST likely root cause of the user’s inability to connect?

   • AThe EC2 key pair on the instance is mismatched with the user’s key.
   • BThe EC2 instance security group is missing SSH port 22 for inbound traffic.
   • CThe EC2 instance is in a private VPC and is missing the ssmmessages endpoint.
   • DAmazon Linux 2 does not have Systems Manager Agent preinstalled.

   Show answer

   Answer: C

   Next question

6. Question 666 · 732 in bank

   A company is operating an AWS workload that consists of multiple applications that are deployed on Amazon EC2 instances. Recent changes to a security group caused connectivity issues for some application instances that use the security group. The company now needs all changes to security groups to initiate an alert to a specific company email address. Which solution will meet this requirement in the MOST operationally efficient manner?

   • AImplement AWS Config. Configure an AWS Config managed rule to detect changes to security groups. Configure a manual remediation action for noncompliant resources to forward evaluations to an Amazon Simple Notification Service (Amazon SNS) topic.
   • BImplement AWS Config. Configure an AWS Config managed rule to detect changes to security groups. Configure a manual remediation action for noncompliant resources to forward evaluations to an Amazon Simple Queue Service (Amazon SQS) queue.
   • CImplement AWS CloudTrail. Configure forwarding to Amazon CloudWatch Logs. Configure a CloudWatch Logs metric filter with a pattern match on all security group changes. Configure an Amazon CloudWatch alarm to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic.
   • DImplement AWS CloudTrail. Configure forwarding to Amazon S3. Configure an AWS Glue crawler for use with Amazon Athena to query log contents for event patterns that indicate changes to security groups. Publish the query results to an Amazon Simple Queue Service (Amazon SQS) queue.

   Show answer

   Answer: C

   Next question

7. Question 667 · 732 in bank

   Select 2

   A company wants to prevent public exposure of data that is stored in Amazon S3. Which combination of steps should a security engineer take to meet this requirement? (Choose two.)

   • ATurn on S3 Block Public Access.
   • BEnforce S3 bucket encryption by using server-side encryption with AWS KMS managed keys (SSE-KMS).
   • CEnforce S3 bucket encryption by using server-side encryption with Amazon S3 managed encryption keys (SSE-S3).
   • DUse S3 Storage Lens.
   • EUse Amazon Macie.

   Show answer

   Answer: AB

   Next question

8. Question 668 · 732 in bank

   A company that builds document management systems recently performed a security review of its application on AWS. The review showed that uploads of documents through signed URLs into Amazon S3 could occur in the application without encryption in transit. A security engineer must implement a solution that prevents uploads that are not encrypted in transit. Which solution will meet this requirement?

   • AEnsure that all client implementations are using HTTPS to upload documents into the application.
   • BConfigure the s3-bucket-ssl-requests-only managed rule in AWS Config.
   • CAdd an S3 bucket policy that denies all S3 actions for condition “aws:secureTransport”: “false”.
   • DAdd an S3 bucket ACL with a grantee of AllUsers, a permission of WRITE, and a condition of secureTransport.

   Show answer

   Answer: C

   Next question

9. Question 669 · 732 in bank

   A company is designing a multi-account structure for its development teams. The company is using AWS Organizations and AWS Single Sign-On (AWS SSO). The company must implement a solution so that the development teams can use only specific AWS Regions and so that each AWS account allows access to only specific AWS services. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse AWS SSO to set up service-linked roles with IAM policy statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
   • BDeactivate AWS Security Token Service (AWS STS) in Regions that the developers are not allowed to use.
   • CCreate SCPs that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
   • DFor each AWS account, create tailored identity-based policies for AWS SSO. Use statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.

   Show answer

   Answer: C

   Next question

10. Question 670 · 732 in bank

    Select 2

    A developer has created an AWS Lambda function in a company’s development account. The Lambda function requires the use of an AWS Key Management Service (AWS KMS) customer managed key that exists in a security account that the company’s security team controls. The developer obtains the ARN of the KMS key from a previous Lambda function in the development account. The previous Lambda function had been working properly with the KMS key. When the developer uses the ARN and tests the new Lambda function, an error message states that access is denied to the KMS key in the security account. The developer tests the previous Lambda function that uses the same KMS key and discovers that the previous Lambda function still can encrypt data as expected. A security engineer must resolve the problem so that the new Lambda function in the development account can use the KMS key from the security account. Which combination of steps should the security engineer take to meet these requirements? (Choose two.)

    • AIn the security account, configure an IAM role for the new Lambda function. Attach an IAM policy that allows access to the KMS key in the security account.
    • BIn the development account, configure an IAM role for the new Lambda function. Attach a key policy that allows access to the KMS key in the security account.
    • CIn the development account, configure an IAM role for the new Lambda function. Attach an IAM policy that allows access to the KMS key in the security account.
    • DConfigure a key policy for the KMS key in the security account to allow access to the IAM role of the new Lambda function in the security account.
    • EConfigure a key policy for the KMS key in the security account to allow access to the IAM role of the new Lambda function in the development account.

    Show answer

    Answer: CE

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 661. 732 questions available.