SCS-C02 practice questions 711–720

1. Question 711 · 732 in bank

   A company's security administrator receives an AWS Abuse notification that an IAM user's access key might be compromised. A legacy application uses the IAM user. The security administrator must remediate the potential compromise with the least possible downtime to the application. Which solution will meet these requirements?

   • ADelete the IAM user's access key Immediately. Create a new access key to update in the legacy application.
   • BCreate a new access key for the IAM user. Update the latest application version to use the new access key. Deactivate the compromised access key.
   • CAttach an IAM policy to revoke all sessions from before the time of the AWS Abuse notification.
   • DUpdate the legacy application to use an IAM role that has the same permissions as the IAM user.

   Show answer

   Answer: B

   Next question

2. Question 712 · 732 in bank

   A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region. The DB cluster is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. To meet compliance requirements, the company needs to copy a DB snapshot to the us-west-1 Region. However, when the company tries to copy the snapshot to us-west-1, the company cannot access the key that was used to encrypt the original database. What should the company do to set up the snapshot in us-west-1 with proper encryption?

   • AUse AWS Secrets Manager to store the customer managed key in us-west-1 as a secret. Use this secret to encrypt the snapshot in us-west-1.
   • BCreate a new customer managed key in us-west-1. Use this new key to encrypt the snapshot in us-west-1.
   • CCreate an IAM policy that allows access to the customer managed key in us-east-1. Specify arn:aws:kms:us-west-1as the principal.
   • DCreate an IAM policy that allows access to the customer managed key in us-east-1. Specify arn:aws:rds:us-west-1 :* as the principal.

   Show answer

   Answer: B

   Next question

3. Question 713 · 732 in bank

   Select 2

   A company's application uses standard tier secure string parameters from AWS Systems Manager Parameter Store. The application is receiving error messages when the company tries to update a parameter. The parameter uses an AWS Key Management Service (AWS KMS) customer managed key for encryption and decryption. What are the reasons for the error messages? (Choose two.)

   • AThe application does not have the kms:Encrypt permission for the customer managed key.
   • BThe customer managed key is already being used to encrypt another secure string parameter.
   • CStandard tier secure string parameters cannot use a customer managed key for encryption.
   • DThe customer managed key that is specified in the application has its key state set to Disabled.
   • EThe customer managed key that is specified in the application is using a key alias instead of a key ID.

   Show answer

   Answer: AD

   Next question

4. Question 714 · 732 in bank

   A security engineer receives a notice from the AWS Abuse team about suspicious activity from a Linux-based Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making connections to known malicious addresses. The instance is in a development account within a VPC that is in the us-east-1 Region. The VPC contains an internet gateway and has a subnet in us-east-1a and us-east-1 b. Each subnet is associate with a route table that uses the internet gateway as a default route. Each subnet also uses the default network ACL. The suspicious EC2 instance runs within the us-east-1 b subnet. During an initial investigation, a security engineer discovers that the suspicious instance is the only instance that runs in the subnet. Which response will immediately mitigate the attack and help investigate the root cause?

   • ALog in to the suspicious instance and use the netstat command to identify remote connections. Use the IP addresses from these remote connections to create deny rules in the security group of the instance. Install diagnostic tools on the instance for investigation. Update the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections as the first rule during the investigation of the instance.
   • BUpdate the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections as the first rule. Replace the security group with a new security group that allows connections only from a diagnostics security group. Update the outbound network ACL for the us-east-1b subnet to remove the deny all rule. Launch a new EC2 instance that has diagnostic tools. Assign the new security group to the new EC2 instance. Use the new EC2 instance to investigate the suspicious instance.
   • CEnsure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the suspicious EC2 instance will not delete upon termination. Terminate the instance. Launch a new EC2 instance in us-east-1a that has diagnostic tools. Mount the EBS volumes from the terminated instance for investigation.
   • DCreate an AWS WAF web ACL that denies traffic to and from the suspicious instance. Attach the AWS WAF web ACL to the instance to mitigate the attack. Log in to the instance and install diagnostic tools to investigate the instance.

   Show answer

   Answer: B

   Next question

5. Question 715 · 732 in bank

   A security engineer receives an abuse report email message from the AWS Trust and Safety team. The abuse report identifies a resource that appears to be compromised. The abuse report indicates that the resource is an IAM access key that belongs to a DevOps engineer in the security engineer's company. The access key is used in a deployment system that uses AWS Lambda functions to launch AWS CloudFormation stacks. The security engineer must address the abuse report, prevent any further use of the exposed access key, and implement security best practices. Which solution will meet these requirements?

   • ALocate the compromised IAM access key and deactivate or delete the key. Generate new access keys for the Lambda deployment process. Apply the new keys to the deployment system. In the account that contained the compromised key, create a new support case in AWS Support to detail these remediation steps.
   • BDelete or deactivate the compromised IAM access key. Discontinue the use of IAM access keys. Create a new IAM role for the Lambda deployment process. Apply the IAM role to the deployment system Lambda functions. Respond directly to the abuse report message to detail these remediation steps.
   • CLocate the compromised IAM access key. Delete the IAM user that is associated with the access key. Generate a new access key. Store the new key as an AWS Secrets Manager secret. Encrypt the secret with an AWS Key Management Service (AWS KMS) customer managed key. Update the Lambda functions to retrieve the access key from AWS Secrets Manager at runtime. In the account that contained the compromised key, create a new support case in AWS Support to detail these remediation steps.
   • DDelete or deactivate the compromised IAM access key. Generate and store a new access key as an environmental variable within the configuration of the deployment system's Lambda functions. Respond directly to the abuse report message to detail these remediation steps.

   Show answer

   Answer: B

   Next question

6. Question 716 · 732 in bank

   Select 3

   An application team is developing an internal application in its AWS account. Employees will use the application to access their employee benefits information. The application has an Amazon S3 bucket that is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The application team has configured an S3 gateway VPC endpoint for the application to use. During testing, an IAM user is unable to download objects from the S3 bucket by using the AWS Management Console. However, other IAM users in the same AWS account can download objects from the S3 bucket. Which policies or ACL should a security engineer review and modify to resolve this issue? (Choose three.)

   • AThe KMS customer managed key policy.
   • BThe S3 VPC endpoint policy.
   • CThe S3 bucket policy.
   • DThe S3 ACL.
   • EThe IAM policy.
   • FThe KMS VPC endpoint policy.

   Show answer

   Answer: ACE

   Next question

7. Question 717 · 732 in bank

   Select 2

   A company uses Amazon API Gateway to present REST APIs to users. An API developer wants to analyze API access patterns without the need to parse the log files. Which combination of steps will meet these requirements with the LEAST effort? (Choose two.)

   • AConfigure access logging for the required API stage.
   • BConfigure an AWS CloudTrail trail destination for API Gateway events. Configure filters on the userIdentity, userAgent, and sourceIPAddress fields.
   • CConfigure an Amazon S3 destination for API Gateway logs. Run Amazon Athena queries to analyze API access information.
   • DUse Amazon CloudWatch Logs Insights to analyze API access information.
   • ESelect the Enable Detailed CloudWatch Metrics option on the required API stage.

   Show answer

   Answer: AD

   Next question

8. Question 718 · 732 in bank

   A systems engineer deployed containers from several custom-built images that an application team provided through a QA workflow. The systems engineer used Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type as the target platform. The system engineer now needs to collect logs from all containers into an existing Amazon CloudWatch log group. Which solution will meet this requirement?

   • ATurn on the awslogs log driver by specifying parameters for awslogs-group and awslogs-region in the LogConfiguration property.
   • BDownload and configure the CloudWatch agent on the container instances.
   • CSet up Fluent Bit and FluentD as a DaemonSet to send logs to Amazon CloudWatch Logs.
   • DConfigure an IAM policy that includes the logs:CreateLogGroup action. Assign the policy to the container instances.

   Show answer

   Answer: A

   Next question

9. Question 719 · 732 in bank

   A company wants to deny a specific federated user named Bob access to an Amazon S3 bucket named DOC-EXAMPLE-BUCKET. The company wants to meet this requirement by using a bucket policy. The company also needs to ensure that this bucket policy affects Bob's S3 permissions only. Any other permissions that Bob has must remain intact. Which policy should the company use to meet these requirements?

   • A//IMG//
   • B//IMG//
   • C//IMG//
   • D//IMG//

   Show answer

   Answer: B

   Next question

10. Question 720 · 732 in bank

    A company has an automation process. As part of the automation process, an AWS Lambda function needs to access a set of JSON documents that the company stores in an Amazon S3 bucket that uses server-side encryption with AWS KMS keys (SSE-KMS). The company uses a symmetric customer managed key The automation process works as expected for small files. However, the automation encounters errors for files that are larger than 4 KB. What are the MINIMUM KMS policy Action elements that will allow the company to use this key to encrypt and decrypt files that are larger than 4 KB?

    • A//IMG//
    • B//IMG//
    • C//IMG//
    • D//IMG//

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 711. 732 questions available.