SCS-C02 practice questions 691–700

1. Question 691 · 732 in bank

   A company released a new software-as-a-service (SaaS) application that is receiving significant adoption by end users. The rds-storage-encrypted AWS Config managed rule generates an alert that notifies the company’s security team about a resource that is not compliant. The noncompliant resource is an Amazon RDS for MySQL database that was deployed as part of the newly released application. How can the security team resolve the noncompliance with the LEAST disruption of application availability for the end users?

   • AUse AWS Database Migration Service (AWS DMS) with full load and change data capture (CDC) between the noncompliant database and a new database with storage encrypted. When full load is finished, cut over any application endpoints to the new encrypted database.
   • BCreate a snapshot of the noncompliant DB instance. Make a copy of the snapshot in the same AWS Region with encryption configured. Restore the snapshot as a new DB instance. Cut over any application endpoints to the newly restored database.
   • CDeploy a patch to the application to stop writing to the noncompliant database. Enable storage encryption by using the AWS CLI. Patch the application again to restore writing to the database.
   • DAdd a read replica to the noncompliant DB instance. Enable storage encryption on the read replica. When the read replica is available, cut over from the writer DB instance to the read replica. Delete the unencrypted DB instance after the cutover.

   Show answer

   Answer: A

   Next question

2. Question 692 · 732 in bank

   A company’s security engineer must record when specific AWS Lambda functions are invoked. The logs must include the AWS principal that invoked the function. External sources and the company’s developers deliver the Lambda function code by using a variety of languages such as Python, Node.js, and Golang. The security engineer has created an AWS CloudTrail trail with default configuration for the AWS account. Which solution will meet these requirements with the LEAST operational overhead?

   • AUpdate the Lambda function code to extract the AWS principal from the Lambda context and to write a log entry when the function to be monitored is invoked.
   • BUse Amazon EventBridge (Amazon CloudWatch Events) to configure a rule and custom pattern for lambda:invoke events with a filter on the functions to monitor. Invoke another Lambda function to write the EventBridge (CloudWatch Events) data to Amazon CloudWatch Logs.
   • CModify the existing CloudTrail trail. Configure the existing CloudTrail trail to monitor Lambda functions as data events.
   • DCreate a Lambda layer that provides CloudTrail with a log event that includes the Lambda context when the function is invoked. Attach this layer to all Lambda functions that must be monitored.

   Show answer

   Answer: C

   Next question

3. Question 693 · 732 in bank

   Select 3

   A company wants to use AWS Systems Manager Patch Manager to patch Amazon EC2 instances that run Amazon Linux 2. The EC2 instances are running in a single AWS account. No internet connectivity is allowed from any EC2 instances in the account. A security engineer has configured the relevant settings in Patch Manager. The security engineer now needs to ensure that the EC2 instances can connect to the Systems Manager endpoint. Which combination of steps must the security engineer take to meet these requirements? (Choose three.)

   • ACreate a gateway VPC endpoint for com.amazonaws.[region].s3.
   • BCreate VPC endpoints for com.amazonaws.[region].ec2messages and com.amazonaws.[region].ssm.
   • CCreate a NAT gateway.
   • DUpdate the route tables to route Systems Manager traffic through the NAT gateway.
   • EUpdate the route tables with a route to the gateway VPC endpoint.
   • FUpdate the route tables to route the update traffic through the NAT gateway.

   Show answer

   Answer: ABE

   Next question

4. Question 694 · 732 in bank

   A company hosts business-critical applications on Amazon EC2 instances in a VPC. The VPC uses default DHCP options sets. A security engineer needs to log all DNS queries that internal resources make in the VPC. The security engineer also must create a list of the most common DNS queries over time. Which solution will meet these requirements?

   • AInstall the Amazon CloudWatch agent on each EC2 instance in the VPC. Use the CloudWatch agent to stream the DNS query logs to an Amazon CloudWatch Logs log group. Use CloudWatch metric filters to automatically generate metrics that list the most common DNS queries.
   • BInstall a BIND DNS server in the VPC. Create a bash script to list the DNS request number of common DNS queries from the BIND logs.
   • CCreate VPC flow logs for all subnets in the VPStream the flow logs to an Amazon CloudWatch Logs log group. Use CloudWatch Logs Insights to list the most common DNS queries for the log group in a custom dashboard.
   • DConfigure Amazon Route 53 Resolver query logging. Add an Amazon CloudWatch Logs log group as the destination. Use Amazon CloudWatch Contributor Insights to analyze the data and create time series that display the most common DNS queries.

   Show answer

   Answer: D

   Next question

5. Question 695 · 732 in bank

   A company uses Amazon Route 53 to create a public DNS zone for the domain example.com in Account A. The company creates another public DNS zone for the subdomain dev.example.com in Account B. A security engineer creates a wildcard certificate (*.dev.example.com) with DNS validation by using AWS Certificate Manager (ACM). The security engineer validates that the corresponding CNAME records have been created in the zone for dev.example.com in Account B. After all these operations are completed, the certificate status is still pending validation. What should the security engineer do to resolve this issue?

   • APurchase a valid wildcard certificate authority (CA) certificate that supports managed renewal. Import this certificate into ACM in Account B.
   • BAdd NS records for the subdomain dev.example.com to the Route 53 parent zone example.com in Account A.
   • CUse AWS Certificate Manager Private Certificate Authority to create a subordinate certificate authority (CA). Use ACM to generate a private certificate that supports managed renewal.
   • DResend the email message that requests ownership validation of dev.example.com.

   Show answer

   Answer: B

   Next question

6. Question 696 · 732 in bank

   A security engineer for a company wants to maintain all IAM users and roles according to the principle of least privilege. The security engineer plans to audit the IAM permissions once every 365 days. The security engineer must view the permissions that each IAM identity used in the last 365 days and must remove any unused permissions. Which solution will meet these requirements?

   • AUse AWS CloudTrail logs to review IAM identity actions and to remove unused permissions.
   • BUse AWS Config to review configuration changes by each IAM identity and to remove unused permissions.
   • CUse AWS Identity and Access Management Access Analyzer to review last accessed information and to remove unused permissions.
   • DUse AWS Trusted Advisor to check the IAM identities that have elevated permissions and to remove unused permissions.

   Show answer

   Answer: C

   Next question

7. Question 697 · 732 in bank

   A company uses AWS Organizations to manage 20 AWS accounts. The company has a new requirement to enforce IAM access key rotation every 90 days. Currently, the company uses the access keys to connect to Amazon EC2 instances. The company uses the organization's management account to manage the IAM users of all the accounts. A security administrator needs to develop a solution for the key rotation. Which solution will meet these requirements?

   • AAdd an automatic remediation option to an AWS Config rule for access key rotation. Create an AWS Systems Manager Automation runbook. Use AWS CloudFormation StackSets to deploy the runbook. Activate the AWS Config rule. Link the runbook as the automatic remediation step.
   • BAdd an automatic remediation option to an AWS Config rule for access key rotation. Create an AWS Systems Manager Automation runbook. Use AWS CloudFormation change sets to deploy the runbook. Activate the AWS Config rule. Link the runbook as the automatic remediation step.
   • CAdd an automatic remediation option to an AWS Systems Manager rule for access key rotation. Create a Systems Manager Automation runbook. Use AWS CloudFormation StackSets to deploy the runbook. Activate the Systems Manager rule. Link the runbook as the automatic remediation step.
   • DAdd an automatic remediation option to an AWS Systems Manager rule for access key rotation. Create a Systems Manager Automation runbook. Use AWS CloudFormation change sets to deploy the runbook. Invoke an AWS Lambda function to link the runbook as the automatic remediation step.

   Show answer

   Answer: A

   Next question

8. Question 698 · 732 in bank

   Select 3

   A company has a large number of Amazon S3 buckets and a large number of objects in each S3 bucket. The company's security team wants to analyze the access patterns for the objects and buckets. These patterns include the most frequently accessed buckets and objects, the largest 100 objects downloaded, and the objects with the longest download time from public IP addresses. The security team wants to view this information in a dashboard that is based on predetermined simple SQL queries. Which combination of AWS services and features should a security engineer use to provide and display the information to the security team? (Choose three.)

   • AAmazon CloudWatch Logs Insights
   • BAmazon S3 server access logs
   • CAmazon CloudWatch Logs
   • DAmazon GuardDuty
   • EAmazon QuickSight
   • FAmazon Athena

   Show answer

   Answer: BEF

   Next question

9. Question 699 · 732 in bank

   Select 2

   A company in France uses Amazon Cognito with the Cognito Hosted UI as an identity broker for sign-in and sign-up processes. The company is marketing an application and expects that all the application's users will come from France. When the company launches the application, the company's security team observes fraudulent sign-ups for the application. Most of the fraudulent registrations are from users outside of France. The security team needs a solution to perform custom validation at sign-up. Based on the results of the validation, the solution must accept or deny the registration request. Which combination of steps will meet these requirements? (Choose two.)

   • ACreate a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool.
   • BUse a geographic match rule statement to configure an AWS WAF web ACL. Associate the web ACL with the Amazon Cognito user pool.
   • CConfigure an app client for the application's Amazon Cognito user pool. Use the app client ID to validate the requests in the hosted UI.
   • DUpdate the application's Amazon Cognito user pool to configure a geographic restriction setting.
   • EUse Amazon Cognito to configure a social identity provider (IdP) to validate the requests on the hosted UI.

   Show answer

   Answer: AB

   Next question

10. Question 700 · 732 in bank

    A company wants to store all objects that contain sensitive data in an Amazon S3 bucket. The company will use server-side encryption to encrypt the S3 bucket. The company’s operations team manages access to the company's S3 buckets. The company's security team manages access to encryption keys. The company wants to separate the duties of the two teams to ensure that configuration errors by only one of these teams will not compromise the data by granting unauthorized access to plaintext data. Which solution will meet this requirement?

    • AEnsure that the operations team configures default bucket encryption on the S3 bucket to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to use the encryption keys.
    • BEnsure that the operations team creates a bucket policy that requires requests to use server-side encryption with AWS KMS keys (SSE-KMS) that are customer managed. Ensure that the security team creates a key policy that controls access to the encryption keys.
    • CEnsure that the operations team creates a bucket policy that requires requests to use server-side encryption with Amazon S3 managed keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to the encryption keys.
    • DEnsure that the operations team creates a bucket policy that requires requests to use server-side encryption with customer-provided encryption keys (SSE-C). Ensure that the security team stores the customer-provided keys in AWS Key Management Service (AWS KMS). Ensure that the security team creates a key policy that controls access to the encryption keys.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 691. 732 questions available.