SCS-C02 practice questions 681–690

1. Question 681 · 732 in bank

   Select 3

   A company is designing a solution to serve content from an Amazon CloudFront distribution that will have an Amazon S3 bucket as the origin. A security engineer needs to encrypt S3 data at rest with an AWS Key Management Service (KMS) customer managed key rather than with an S3 managed key. The solution must minimize operational overhead. Which combination of steps should the security engineer take to meet these requirements? (Choose three.)

   • ACreate the S3 bucket. Configure server-side encryption with a customer managed KMS key.
   • BCreate the S3 bucket. Configure server-side encryption with customer-provided encryption keys (SSE-C).
   • CCreate the CloudFront distribution. Use the S3 bucket as the origin. Configure the distribution to use an origin access identity (OAI).
   • DCreate the CloudFront distribution. Use the S3 bucket as the origin. Delete the origin access identity (OAI) configuration.
   • EConfigure the CloudFront distribution cache to encrypt data at rest by using the customer managed KMS key.
   • FCreate a Lambda@Edge function that runs for origin request events and reads from the S3 bucket by using the customer managed KMS key.

   Show answer

   Answer: ADF

   Next question

2. Question 682 · 732 in bank

   A security engineer is attempting to push a Linux-based container image to an Amazon Elastic Container Registry (Amazon ECR) repository that is in the us-east-1 Region. The security engineer has retrieved an authentication token by using the aws ecr get-login-password AWS CLI command within the last 4 hours. The security engineer has confirmed that the correct permissions are in place to push the container image to the repository. When the security engineer tries to push the container image, the security engineer receives the following error: “no basic auth credentials”. What should the security engineer do to resolve this error?

   • AObtain a new authorization token.
   • BConfigure the AWS CLI to use us-east-1.
   • CModify the aws-auth-cm.yaml file to include the IAM role for the security engineer.
   • DActivate AWS Security Token Service (AWS STS) in us-east-1.

   Show answer

   Answer: B

   Next question

3. Question 683 · 732 in bank

   Select 2

   A security engineer is trying to use Amazon EC2 Image Builder to create an image of an EC2 instance. The security engineer has configured the pipeline to send logs to an Amazon S3 bucket. When the security engineer runs the pipeline, the build fails with the following error: “AccessDenied: Access Denied status code: 403”. The security engineer must resolve the error by implementing a solution that complies with best practices for least privilege access. Which combination of steps will meet these requirements? (Choose two.)

   • AEnsure that the following policies are attached to the IAM role that the security engineer is using: EC2InstanceProfileForImageBuilder, EC2InstanceProfileForImageBuilderECRContainerBuilds, and AmazonSSMManagedInstanceCore.
   • BEnsure that the following policies are attached to the instance profile for the EC2 instance: EC2InstanceProfileForImageBuilder, EC2InstanceProfileForImageBuilderECRContainerBuilds, and AmazonSSMManagedInstanceCore.
   • CEnsure that the AWSImageBuilderFullAccess policy is attached to the instance profile for the EC2 instance.
   • DEnsure that the security engineer’s IAM role has the s3:PutObject permission for the S3 bucket.
   • EEnsure that the instance profile for the EC2 instance has the s3:PutObject permission for the S3 bucket.

   Show answer

   Answer: BE

   Next question

4. Question 684 · 732 in bank

   A security engineer needs to configure an Amazon S3 bucket policy to restrict access to an S3 bucket that is named DOC-EXAMPLE-BUCKET. The policy must allow access to only DOC-EXAMPLE-BUCKET from only the following endpoint: vpce-1a2b3c4d. The policy must deny all access to DOC-EXAMPLE-BUCKET if the specified endpoint is not used. Which bucket policy statement meets these requirements?

   • A//IMG//
   • B//IMG//
   • C//IMG//
   • D//IMG//

   Show answer

   Answer: B

   Next question

5. Question 685 · 732 in bank

   Select 2

   A security engineer is working for a parent company that provides hosting and services to client companies. The parent company maintains an organization in AWS Organizations for all client company accounts. The parent company adds any new accounts to the organization when the new accounts are created. The parent company currently uses IAM users to administer the client company accounts. As more client accounts are added, the administration of the IAM accounts takes more time. The security engineer must design a solution to reduce the amount of time that the parent company spends on administration and access provisioning for client accounts. Which combination of steps should the security engineer take to meet these requirements? (Choose two.)

   • AProvision an external identity provider (IdP) for the parent company. Implement AWS Single Sign-On (AWS SSO) with the IdP as the identity source for AWS SSO.
   • BProvision an external identity provider (IdP) for each client company. Implement AWS Single Sign-On (AWS SSO) with the IdPs as the identity source for AWS SSO.
   • CProvision an external identity provider (IdP) for the parent company. Implement AWS Single Sign-On (AWS SSO) with employee IAM roles as the identity source for AWS SSO.
   • DIn the AWS Single Sign-On console, select the users who require access to client accounts. Assign these users to the accounts.
   • EIn the IAM console, select the users who require access to client accounts. Assign these users to the accounts.

   Show answer

   Answer: AD

   Next question

6. Question 686 · 732 in bank

   A security team has received an alert from Amazon GuardDuty that AWS CloudTrail logging has been disabled. The security team’s account has AWS Config, Amazon Inspector, Amazon Detective, and AWS Security Hub enabled. The security team wants to identify who disabled CloudTrail and what actions were performed while CloudTrail was disabled. What should the security team do to obtain this information?

   • AUse AWS Config to search for the CLOUD_TRAIL_ENABLED event. Use the configuration recorder to find all activity that occurred when CloudTrail was disabled.
   • BUse Amazon Inspector to find the details of the CloudTrailLoggingDisabled event from GuardDuly, including the user name and all activity that occurred when CloudTrail was disabled.
   • CUse Detective to find the details of the CloudTrailLoggingDisabled event from GuardDuty, including the user name and all activity that occurred when CloudTrail was disabled.
   • DUse GuardDuty to find which user generated the CloudTrailLoggingDisabled event. Use Security Hub to find the trace of activity related to the event.

   Show answer

   Answer: C

   Next question

7. Question 687 · 732 in bank

   Select 3

   A company has a requirement that none of its Amazon RDS resources can be publicly accessible. A security engineer needs to set up monitoring for this requirement and must receive a near-real-time notification if any RDS resource is noncompliant. Which combination of steps should the security engineer take to meet these requirements? (Choose three.)

   • AConfigure RDS event notifications on each RDS resource. Target an AWS Lambda function that notifies AWS Config of a change to the RDS public access setting
   • BConfigure the rds-instance-public-access-check AWS Config managed rule to monitor the RDS resources.
   • CConfigure the Amazon EventBridge (Amazon CloudWatch Events) rule to target an Amazon Simple Notification Service (Amazon SNS) topic to provide a notification to the security engineer.
   • DConfigure RDS event notifications to post events to an Amazon Simple Queue Service (Amazon SQS) queue. Subscribe the SQS queue to an Amazon Simple Notification Service (Amazon SNS) topic to provide a notification to the security engineer.
   • EConfigure an Amazon EventBridge (Amazon CloudWatch Events) rule that is invoked by a compliance change event from the rds-instance-public-access-check rule.
   • FConfigure an Amazon EventBridge (Amazon CloudWatch Events) rule that is invoked when the AWS Lambda function notifies AWS Config of an RDS event change.

   Show answer

   Answer: BCE

   Next question

8. Question 688 · 732 in bank

   A company’s security engineer has configured a client account to capture AWS CloudTrail logs that are then sent to an Amazon S3 bucket. The S3 bucket that stores these CloudTrail logs has always been configured to use AWS Key Management Service (AWS KMS) with the default KMS key (aws/s3) for encryption. Recently, the company changed the key on the S3 bucket to a new KMS key. Since the modification of the bucket key, the security engineer cannot retrieve new CloudTrail log files that are written to the S3 bucket. The security engineer receives the following error message: “An error occurred (AccessDenied) when calling the GetObject operation: Access Denied”. Log files that were written to the S3 bucket before the bucket key was changed are still accessible. The company used the new KMS key to encrypt other S3 buckets, and the same error is occurring with those S3 buckets. What is the MOST likely cause of this error?

   • AThe security engineer’s IAM user does not have encrypt and decrypt permissions for the new KMS key.
   • BThe security engineer’s IAM user does not have administrative permissions for the new KMS key.
   • CThe S3 bucket policy needs modification to allow users to access objects that are encrypted with the new KMS key.
   • DThe S3 bucket policy needs modification to allow the security engineer’s IAM user to access objects in the S3 bucket.

   Show answer

   Answer: A

   Next question

9. Question 689 · 732 in bank

   A company sends Amazon RDS snapshots to two accounts as part of its disaster recovery (DR) plan. The snapshots must be encrypted. However, each account needs to be able to decrypt the snapshots in case of a DR event. Which solution will meet these requirements?

   • AUse the default AWS Key Management Service (AWS KMS) key to generate the snapshots. Create an AWS Lambda function that copies the KMS encryption key to the two accounts.
   • BUse an AWS Key Management Service (AWS KMS) customer managed key to generate the snapshots. Create an AWS Lambda function that imports the KMS key in the two accounts.
   • CUse the default AWS Key Management Service (AWS KMS) key to generate the snapshots. Share the KMS key with the two accounts by using an IAM principal that has the proper KMS permissions in each account.
   • DUse an AWS Key Management Service (AWS KMS) customer managed key to generate the snapshots. Share the KMS key with the two accounts by using an IAM principal that has the proper KMS permissions in each account.

   Show answer

   Answer: D

   Next question

10. Question 690 · 732 in bank

    A company plans to use AWS CodeDeploy to deploy code to multiple Amazon EC2 instances in a VPC at the same time. The company needs to allow the CodeDeploy service to communicate with the instances in the VPC without going through the public internet for CodeDeploy API operations. What should a security engineer do to meet this requirement?

    • AUse a NAT gateway in the VPC.
    • BUse an interface VPC endpoint for CodeDeploy API operations.
    • CUse a gateway VPC endpoint for CodeDeploy API operations.
    • DUse a VPN connection to the VPC.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 681. 732 questions available.