SCS-C02 practice questions 671–680

1. Question 671 · 732 in bank

   A company needs to restrict access to Amazon DynamoDB tables in the us-east1 Region for account 0123456789. All users must be denied permission to work with DynamoDB tables in us-east-1 unless the users access the tables through the following endpoint: vpce-11aa22bb. Which IAM statement will enforce this requirement?

   • A//IMG//
   • B//IMG//
   • C//IMG//
   • D//IMG//

   Show answer

   Answer: D

   Next question

2. Question 672 · 732 in bank

   A security engineer is attempting to assign a virtual multi-factor authentication (MFA) device to an IAM user whose current virtual MFA device is faulty. The security engineer receives an error message that indicates that the security engineer is not authorized to perform iam:DeleteVirtualMFADevice. The IAM role that the security engineer is using has the correct permissions to delete, list, and create a virtual MFA device. The IAM user also has permissions to delete their own virtual MFA device, but only if the IAM user is authenticated with MFA. What should the security engineer do to resolve this issue?

   • AModify the policy for the IAM user to allow the IAM user to delete the virtual MFA device without using MFA authentication.
   • BSign in as the AWS account root user. Modify the MFA device by using the IAM console to generate a new synchronization quick response (QR) code.
   • CUse the AWS CLI or AWS API to find the ARN of the virtual MFA device and to delete the device.
   • DSign in as the AWS account root user. Delete the virtual MFA device by using the IAM console.

   Show answer

   Answer: C

   Next question

3. Question 673 · 732 in bank

   A company’s data is encrypted in an Amazon S3 bucket by an AWS Key Management Service (AWS KMS) customer managed key. The company has AWS Lambda functions that run in the same account as the S3 bucket. The Lambda functions need to access the data in the S3 bucket. A security engineer must ensure that each Lambda function has its own programmatic access control permissions to use the KMS key. What should the security engineer do to meet this requirement?

   • ACreate Lambda IAM users for each Lambda function. Attach an IAM policy that includes specific access permissions to use the KMS key.
   • BCreate a key grant for the Lambda service principal. Add or remove specific access permissions to use the KMS key.
   • CCreate a Lambda execution role that provides specific access permissions to use the KMS key for each Lambda function.
   • DConfigure each Lambda function to assume an IAM role that provides specific access permissions to use the AWS managed KMS key for Amazon S3.

   Show answer

   Answer: C

   Next question

4. Question 674 · 732 in bank

   Select 2

   A company allows users to download its mobile app onto their phones. The app is MQTT based and connects to AWS IoT Core to subscribe to specific client-related topics. Recently, the company discovered that some malicious attackers have been trying to get a Trojan horse onto legitimate mobile phones. The Trojan horse poses as the authentic application and uses a client ID with injected special characters to gain access to topics outside the client’s privilege scope. Which combination of actions should the company take to prevent this threat? (Choose two.)

   • AIn the application, use an IoT thing name as the client ID to connect the device to AWS IoT Core.
   • BIn the application, add a client ID check. Disconnect from the server if any special character is detected.
   • CApply an AWS IoT Core policy that allows “AWSIoTWirelessDataAccess” with the principal set to “client/${iot:Connection.Thing.ThingName}”.
   • DApply an AWS IoT Core policy to the device to allow “iot:Connect” with the resource set to “client/${iot:ClientId}”.
   • EApply an AWS IoT Core policy to the device to allow “iot:Connect” with the resource set to “client/${iot:Connection.Thing.ThingName}”.

   Show answer

   Answer: AE

   Next question

5. Question 675 · 732 in bank

   Select 2

   A company’s public Application Load Balancer (ALB) recently experienced a DDoS attack. To mitigate this issue. the company deployed Amazon CloudFront in front of the ALB so that users would not directly access the Amazon EC2 instances behind the ALB. The company discovers that some traffic is still coming directly into the ALB and is still being handled by the EC2 instances. Which combination of steps should the company take to ensure that the EC2 instances will receive traffic only from CloudFront? (Choose two.)

   • AConfigure CloudFront to add a cache key policy to allow a custom HTTP header that CloudFront sends to the ALB.
   • BConfigure CloudFront to add a custom: HTTP header to requests that CloudFront sends to the ALB.
   • CConfigure the ALB to forward only requests that contain the custom HTTP header.
   • DConfigure the ALB and CloudFront to use the X-Forwarded-For header to check client IP addresses.
   • EConfigure the ALB and CloudFront to use the same X.509 certificate that is generated by AWS Certificate Manager (ACM).

   Show answer

   Answer: BC

   Next question

6. Question 676 · 732 in bank

   Select 2

   A company has two web applications that run on Amazon EC2 and Amazon S3. The applications failed an HTTP security audit, and users are reporting latency issues. The applications need to deliver web content at low latencies while improving security and privacy for users and content providers. The company must implement a solution that does not require changes to the application code. Which combination of actions should the company take to meet these requirements? (Choose two.)

   • ADeploy Amazon API Gateway. Cache the endpoint’s responses.
   • BConfigure Amazon API Gateway with a request parameter-based AWS Lambda authorizer to add HTTP security headers on origin responses.
   • CWrite a Lambda@Edge function to add HTTP security headers on origin responses.
   • DConfigure Amazon CloudFront. Create a distribution for the EC2 and S3 origins.
   • EImplement an Application Load Balancer (ALB) to honor the connection header from the incoming client request after forwarding the response back to the client.

   Show answer

   Answer: CD

   Next question

7. Question 677 · 732 in bank

   A company’s application runs on an Amazon EC2 instance and stores objects in an Amazon S3 bucket. The EC2 instance is using an instance profile that provides access to read and write objects in the S3 bucket. The S3 bucket contains objects and has not been configured for any encryption at rest. The company is adopting a new security policy that mandates encryption at rest for all S3 buckets, encryption at rest for all objects in S3 buckets, and key rotation once every year. What should a security engineer do to meet these requirements?

   • AEnable server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for the S3 bucket. Configure annual automatic key rotation. Use an S3 Batch Operations job with the COPY command to change all the objects in the S3 bucket to use the SSE-S3 key. Configure the EC2 instance profile with permissions to use the SSE-S3 key. Configure S3 data events to encrypt an object during a write operation.
   • BCreate a new AWS Key Management Service (AWS KMS) customer managed key. Configure annual automatic key rotation. Enable server-side encryption with AWS KMS keys (SSE-KMS) for the S3 bucket. Add a bucket policy to the S3 bucket to enforce SSE-KMS encryption. Configure the EC2 instance profile with permissions to use the customer managed key.
   • CCreate a new AWS Key Management Service (AWS KMS) customer managed key. Configure annual automatic key rotation. Enable server-side encryption with AWS KMS keys (SSE-KMS) for the S3 bucket. Use an S3 Batch Operations job with the COPY command to change all the objects in the S3 bucket to use the customer managed key. Configure the EC2 instance profile with permissions to use the customer managed key.
   • DEnable server-side encryption with Amazon S3 managed encryption keys (SSE-S3) for the S3 bucket. Configure annual automatic key rotation. Configure the EC2 instance profile with permissions to use the SSE-S3 key. Use the AWS CLI to copy the S3 objects in place by specifying the SSE-S3 key as the encryption key. Configure S3 data events to encrypt an object during a write operation.

   Show answer

   Answer: C

   Next question

8. Question 678 · 732 in bank

   A company uses AWS Organizations. According to compliance requirements, the company’s applications that are hosted on Amazon EC2 instances must never use IAM credentials from Instance Metadata Service Version 1 (IMDSv1). What should a security engineer do to meet this requirement?

   • ACreate a security group that denies access on HTTP to 169.254.169.254. Attach this security group to all EC2 instances.
   • BDeactivate all access to IMDSv1 through the instance metadata options when using the AWS CLI, AWS API, or AWS Management Console to launch an EC2 instance.
   • CAttach the following SCP to the root OU in AWS Organizations: //IMG//
   • DAttach the following SCP to the root OU in AWS Organizations: //IMG//

   Show answer

   Answer: D

   Next question

9. Question 679 · 732 in bank

   A company has a single-page application (SPA) that is served by Amazon CloudFront. An Amazon S3 bucket is the origin of the CloudFront distribution. The company is using Amazon Cognito for authentication. An external security review reveals that unauthenticated users can download the application source code from the SPA in index.html and view internal details of the SPA. A security engineer needs to implement a solution to avoid exposing the source code to unauthenticated users. Which solution will meet these requirements?

   • ASplit the login logic to a separate login.html page. Designate the new page as the landing page. Attach an AWS WAF web ACL to the CloudFront distribution to deny unauthenticated requests to index html.
   • BChange the authentication method in Amazon Cognito to use an AWS Lambda authorizer. Configure the Lambda authorizer to control authentication and disallow downloads if the user is not authenticated.
   • CImplement an Amazon Cognito hosted UI for the login. Add Lambda@Edge logic to the CloudFront distribution to either serve content or redirect to the login page.
   • DCreate an origin access identity (OAI). Associate the OAI with the CloudFront distribution. Configure S3 bucket permissions for the OAI to allow access to authenticated users only.

   Show answer

   Answer: C

   Next question

10. Question 680 · 732 in bank

    A company is using HTTPS for all its public endpoints. A third-party certificate authority (CA) issues the certificates. The company imports the certificates and attaches the certificates to an Elastic Load Balancer or an Amazon CloudFront distribution. The company also is using a third-party DNS hosting provider. The certificates are near expiration. The company wants to migrate to AWS Certificate Manager (ACM) with automatic renewal. When the company adds the CNAME record during DNS validation, the certificate status changes to Failed. What is the root cause of this issue?

    • ADNS validation requires the domain to be hosted on Amazon Route 53.
    • BAutomatic renewal for domain validation requires the domain to be hosted on Amazon Route 53.
    • CThe domain has Certification Authority Authorization (CAA) DNS records that allow only specific certificate authorities.
    • DDNS validation requires a TXT record instead of a CNAME record.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 671. 732 questions available.