SCS-C02 practice questions 701–710

1. Question 701 · 732 in bank

   A company wants to protect its website from man-in-the-middle attacks by using Amazon CloudFront. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse the SimpleCORS managed response headers policy.
   • BUse a Lambda@Edge function to add the Strict-Transport-Security response header.
   • CUse the SecurityHeadersPolicy managed response headers policy.
   • DInclude the X-XSS-Protection header in a custom response headers policy.

   Show answer

   Answer: C

   Next question

2. Question 702 · 732 in bank

   A security team is developing an automated solution that uses an AWS Lambda function to provision an Amazon EC2 instance. The solution will provision the EC2 instance with an IAM role that has the permissions necessary to make API calls to other AWS services in the same AWS account. The security team can create the AMI for this EC2 instance. The team encrypts the AMI by using an AWS Key Management Service (AWS KMS) customer managed key. When the team invokes the Lambda function to launch the EC2 instance, the team receives an access denied error message from the Lambda function’s execution role. The team analyzes the Lambda function execution role for missing permissions. What is the MOST likely cause of this error message?

   • AThe Lambda function’s execution role does not have kms:CreateGrant and kms:Decrypt KMS key permissions for the encrypted AMI.
   • BThe Lambda function's execution role does not have iam:PassRole permission for the requested IAM instance profile.
   • CThe company has reached the account's service quota for the EC2 instance type that the Lambda function is provisioning in the AWS Region.
   • DThe Lambda function’s execution role does not have Amazon CloudWatch read and write permissions for the configured CloudWatch agent on the EC2 instance.

   Show answer

   Answer: B

   Next question

3. Question 703 · 732 in bank

   A company has deployed workloads in multiple AWS accounts that are all within a single organization in AWS Organizations. The company is using Amazon CloudWatch Logs to implement a new logging solution. The company runs a workload on Amazon EC2 instances that are in an account within the organization. The company has installed the CloudWatch agent on each workload instance and has configured the agent identically on each instance. The configuration specifies that application logs will be forwarded to CloudWatch Logs. The workload VPC has both public and private subnet tiers. The EC2 instances that are in the public subnets have the frontend-instance-role IAM role attached. The EC2 instances that are in the private subnets have the backend-instance-role IAM role attached. The workload uses VPC endpoints to communicate with various AWS services. Recently, log records from instances that use the frontend-instance-role role stopped appearing in CloudWatch Logs. CloudWatch Logs still receives log files from instances that use the backend-instance-role role. Which reason explains why the EC2 instances that use the frontend-instance-role stopped sending logs to CloudWatch Logs?

   • AAn inline IAM policy that is attached to the frontend-instance-role IAM role has been modified. The logs:PutLogEvents allow action has been removed.
   • BAn SCP that includes a logs:PutLogEvents deny statement has been applied to the AWS account.
   • CA CloudWatch monitoring VPC endpoint policy has been updated. A deny statement has been added.
   • DA customer managed IAM policy that is attached to the frontend-instance-role and backend-instance-role IAM roles has been modified. The logs:PutLogEvents allow action has been removed.

   Show answer

   Answer: A

   Next question

4. Question 704 · 732 in bank

   An Amazon EC2 Auto Scaling group launches Amazon Linux EC2 instances and installs the Amazon CloudWatch agent to publish logs to Amazon CloudWatch Logs. The EC2 instances launch with an IAM role that has an IAM policy attached. The policy provides access to publish custom metrics to CloudWatch. The EC2 instances run in a private subnet inside a VPC. The VPC provides access to the internet for private subnets through a NAT gateway. A security engineer notices that no logs are being published to CloudWatch Logs for the EC2 instances that the Auto Scaling group launches. The security engineer validates that the CloudWatch Logs agent is running and is configured properly on the EC2 instances. In addition, the security engineer validates that network communications are working properly to AWS services. What can the security engineer do to ensure that the logs are published to CloudWatch Logs?

   • AConfigure the IAM policy in use by the IAM role to have access to the required cloudwatch: API actions that will publish logs.
   • BAdjust the Amazon EC2 Auto Scaling service-linked role to have permissions to write to CloudWatch Logs.
   • CConfigure the IAM policy in use by the IAM role to have access to the required AWS logs: API actions that will publish logs.
   • DAdd an interface VPC endpoint to provide a route to CloudWatch Logs.

   Show answer

   Answer: A

   Next question

5. Question 705 · 732 in bank

   A company uses AWS Key Management Service (AWS KMS). During an attempt to attach an encrypted Amazon Elastic Block Store (Amazon EBS) volume to an Amazon EC2 instance, the attachment fails. The company discovers that a customer managed key has become unusable because the key material for the key was deleted. The company needs the data that is on the EBS volume. A security engineer must recommend a solution to decrypt the EBS volume's encrypted data key. The solution must also attach the volume to the EC2 instance. Which solution will meet these requirements?

   • AImport new key material into the key. Attach the EBS volume.
   • BRestore the EBS volume from a snapshot that was taken before the deletion of the key material.
   • CReimport the same key material that originally was imported into the key. Attach the EBS volume.
   • DCreate a new key. Import new key material. Attach the EBS volume.

   Show answer

   Answer: C

   Next question

6. Question 706 · 732 in bank

   A company is using AWS Organizations with all features enabled. The company has an AWS management account under an organization's root and a small number of AWS accounts under a child OU. The company expects to grow by more than 1,000 AWS accounts in the next year. The company wants to enforce a policy that disallows any configuration changes to AWS Config settings in all AWS Organizations member accounts automatically when the company creates member accounts. The company will enforce this policy on all existing accounts and on any future AWS accounts that the company creates. The company also wants a centralized view of the compliance status of all accounts. Which solution will meet these requirements?

   • AConfigure AWS Config with trusted access in the Organizations management account.
   • BConfigure AWS Control Tower to extend governance to the organization. Enroll Organizations member accounts.
   • CUse AWS Config to review the enforcement compliance of each AWS account.
   • DCreate an SCP that denies access to all AWS Config API actions. Apply the SCP to the organization's root.

   Show answer

   Answer: B

   Next question

7. Question 707 · 732 in bank

   A company's application uses Amazon DynamoDB to store data. The company's security policy requires all data to be encrypted at rest. The security policy also requires the company to use an on-premises hardware security module (HSM) to generate and manage the company's encryption keys. A security engineer uses the on-premises HSM to generate an encryption key. What should the security engineer do next to meet these requirements?

   • AGenerate a new AWS Key Management Service (AWS KMS) customer managed key. Import the new key material. Grant DynamoDB access to use the key. Create a new DynamoDB table, and select the new key as the encryption key. Import the data into DynamoDB.
   • BGenerate a new AWS Key Management Service (AWS KMS) customer managed key. Import the new key material. Create a new DynamoDB table, and select the new key as the encryption key. Disable the KMS key after table creation. Import the data into DynamoDB.
   • CGenerate a new AWS Key Management Service (AWS KMS) AWS managed key. Import the new key material. Grant DynamoDB access to use the key. Create a new DynamoDB table, and select the new key as the encryption key. Import the data into DynamoDB.
   • DGenerate a new AWS Key Management Service (AWS KMS) AWS managed key. Import the new key material. Use the AWS SDK integration with AWS KMS to encrypt the data locally by using the new KMS key. Create a new DynamoDB table, and select the new key as the encryption key. Disable the KMS key after table creation. Import the data into DynamoDB.

   Show answer

   Answer: A

   Next question

8. Question 708 · 732 in bank

   A systems engineer must design and troubleshoot AWS services for a new project. The project deploys applications onto two Amazon EC2 instances that are named EC2A and EC2B. Both instances need to encrypt dozens of files by using an AWS Key Management Service (AWS KMS) customer managed key. The key has the following key policy:

   

   EC2RoleA is the role that EC2A uses. This role does not have any IAM policy that is related to AWS KMS. EC2RoleB is the role that EC2B uses. This role has the following IAM policy:

   

   Both IAM roles are within the same AWS account that contains the customer managed key. What will happen when EC2Aand EC2B attempt to use the customer managed key?

   • ABoth EC2A and EC2B can use the customer managed key properly for encryption.
   • BNeither EC2A nor EC2B will be able to use the customer managed key for encryption.
   • CEC2A cannot use the customer managed key for encryption. EC2B can use the customer managed key for encryption.
   • DEC2A can use the customer managed key for encryption. EC2B cannot use the customer managed key for encryption.

   Show answer

   Answer: D

   Next question

9. Question 709 · 732 in bank

   A company wants to deploy a continuous security threat-detection service at scale to automatically analyze all the company’s member accounts in AWS Organizations within the ap-east-1 Region. The company’s organization includes a management account, a security account, and many member accounts. When the company creates a new member account, the threat-detection service should automatically analyze the new account so that the company can review any findings from the security account. Which solution uses AWS security best practices and meets these requirements with the LEAST effort?

   • AActivate Amazon GuardDuty in ap-east-1. Designate the security account as the GuardDuty delegated administrator by using the console.
   • BActivate Amazon GuardDuty in ap-east-1 with trusted access to AWS Organizations. Designate the management account as the GuardDuty organization administrator.
   • CActivate AWS Security Hub in ap-east-1. Designate the management account as the Security Hub delegated administrator by using the console.
   • DActivate AWS Control Tower in ap-east-1 with trusted access to AWS Organizations. Designate the security account as the organization administrator.

   Show answer

   Answer: A

   Next question

10. Question 710 · 732 in bank

    A web application gives users the ability to log in, verify their membership’s validity, and browse artifacts that are stored in an Amazon S3 bucket. When a user attempts to download an object, the application must verify the permission to access the object and allow the user to download the object from a custom domain name such as example.com. What is the MOST secure way for a security engineer to implement this functionality?

    • AConfigure read-only access to the object by using a bucket ACL. Remove the access after a set time has elapsed.
    • BImplement an IAM policy to give the user read access to the S3 bucket.
    • CCreate an S3 presigned URL. Provide the S3 presigned URL to the user through the application.
    • DCreate an Amazon CloudFront signed URL. Provide the CloudFront signed URL to the user through the application.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 701. 732 questions available.