SCS-C02 practice questions 71–80

1. Question 71 · 732 in bank

   What is the function of the following AWS Key Management Service (KMS) key policy attached to a customer master key (CMK)?

   

   • AThe Amazon WorkMail and Amazon SES services have delegated KMS encrypt and decrypt permissions to the ExampleUser principal in the 111122223333 account.
   • BThe ExampleUser principal can transparently encrypt and decrypt email exchanges specifically between ExampleUser and AWS.
   • CThe CMK is to be used for encrypting and decrypting only when the principal is ExampleUser and the request comes from WorkMail or SES in the specified region.
   • DThe key policy allows WorkMail or SES to encrypt or decrypt on behalf of the user for any CMK in the account.

   Show answer

   Answer: C

   Next question

2. Question 72 · 732 in bank

   A company has a large fleet of Linux Amazon EC2 instances and Windows EC2 instances that run in private subnets. The company wants all remote administration to be performed as securely as possible in the AWS Cloud. Which solution will meet these requirements?

   • ADo not use SSH-RSA private keys during the launch of new instances Implement AWS Systems Manager Session Manager
   • BGenerate new SSH-RSA private keys for existing instances Implement AWS Systems Manager Session Manager
   • CDo not use SSH-RSA private keys during the launch of new instances Configure EC2 Instance Connect
   • DGenerate new SSH-RSA private keys for existing instances Configure EC2 Instance Connect

   Show answer

   Answer: A

   Explanation

   Answer is A Definitely not C or D because EC2 Instance Connect supports only linux instances https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-linux-inst-eic.html Session Manager provides secure and auditable node management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys. Session Manager provides support for Windows, Linux, and macOS from a single tool. https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html

   Source: Adapted from community discussion — Zek

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 73 · 732 in bank

   A Security Engineer who was reviewing AWS Key Management Service (AWS KMS) key policies found this statement in each key policy in the company AWS account.

   

   What does the statement allow?

   • AAll principals from all AWS accounts to use the key.
   • BOnly the root user from account 111122223333 to use the key.
   • CAll principals from account 111122223333 to use the key but only on Amazon S3.
   • DOnly principals from account 111122223333 that have an IAM policy applied that grants access to this key to use the key.

   Show answer

   Answer: D

   Next question

4. Question 74 · 732 in bank

   Select 2

   A company has decided to move its fleet of Linux-based web server instances to an Amazon EC2 Auto Scaling group. Currently, the instances are static and are launched manually. When an administrator needs to view log files, the administrator uses SSH to establish a connection to the instances and retrieves the logs manually. The company often needs to query the logs to produce results about application sessions and user issues. The company does not want its new automatically scaling architecture to result in the loss of any log files when instances are scaled in. Which combination of steps should a security engineer take to meet these requirements MOST cost-effectively? (Choose two.)

   • AConfigure a cron job on the instances to forward the log files to Amazon S3 periodically.
   • BConfigure AWS Glue and Amazon Athena to query the log files.
   • CConfigure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs.
   • DConfigure Amazon CloudWatch Logs Insights to query the log files.
   • EConfigure the instances to write the logs to an Amazon Elastic File System (Amazon EFS) volume.

   Show answer

   Answer: CD

   Explanation

   My answer is C & D Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs: This approach ensures that log files are automatically collected and stored in Amazon CloudWatch Logs, which can be queried using CloudWatch Logs Insights. This method is cost-effective because it leverages Amazon CloudWatch, which is included in the cost of running EC2 instances. Configure CloudWatch Logs Insights to query the log files: CloudWatch Logs Insights is a fully managed service that allows you to query and analyze log data in real-time. It is integrated with Amazon CloudWatch Logs, making it a natural choice for querying log files.

   Source: Adapted from community discussion — aescudero51

   Next question

5. Question 75 · 732 in bank

   A Software Engineer wrote a customized reporting service that will run on a fleet of Amazon EC2 instances. The company security policy states that application logs for the reporting service must be centrally collected. What is the MOST efficient way to meet these requirements?

   • AWrite an AWS Lambda function that logs into the EC2 instance to pull the application logs from the EC2 instance and persists them into an Amazon S3 bucket.
   • BEnable AWS CloudTrail logging for the AWS account, create a new Amazon S3 bucket, and then configure Amazon CloudWatch Logs to receive the application logs from CloudTrail.
   • CCreate a simple cron job on the EC2 instances that synchronizes the application logs to an Amazon S3 bucket by using rsync.
   • DInstall the Amazon CloudWatch Logs Agent on the EC2 instances, and configure it to send the application logs to CloudWatch Logs.

   Show answer

   Answer: D

   Next question

6. Question 76 · 732 in bank

   A company uses an external identity provider to allow federation into different AWS accounts. A security engineer for the company needs to identify the federated user that terminated a production Amazon EC2 instance a week ago. What is the FASTEST way for the security engineer to identify the federated user?

   • AReview the AWS CloudTrail event history logs in an Amazon S3 bucket and look for the TerminateInstances event to identify the federated user from the role session name.
   • BFilter the AWS CloudTrail event history for the TerminateInstances event and identify the assumed IAM role. Review the AssumeRoleWithSAML event call in CloudTrail to identify the corresponding username.
   • CSearch the AWS CloudTrail logs for the TerminateInstances event and note the event time. Review the IAM Access Advisor tab for all federated roles. The last accessed time should match the time when the instance was terminated.
   • DUse Amazon Athena to run a SQL query on the AWS CloudTrail logs stored in an Amazon S3 bucket and filter on the TerminateInstances event. Identify the corresponding role and run another query to filter the AssumeRoleWithWebIdentity event for the user name.

   Show answer

   Answer: B

   References

   • AWS documentation

   Next question

7. Question 77 · 732 in bank

   A Security Engineer is trying to determine whether the encryption keys used in an AWS service are in compliance with certain regulatory standards. Which of the following actions should the Engineer perform to get further guidance?

   • ARead the AWS Customer Agreement.
   • BUse AWS Artifact to access AWS compliance reports.
   • CPost the question on the AWS Discussion Forums.
   • DRun AWS Config and evaluate the configuration outputs.

   Show answer

   Answer: B

   Next question

8. Question 78 · 732 in bank

   Two Amazon EC2 instances in different subnets should be able to connect to each other but cannot. It has been confirmed that other hosts in the same subnets are able to communicate successfully, and that security groups have valid ALLOW rules in place to permit this traffic. Which of the following troubleshooting steps should be performed?

   • ACheck inbound and outbound security groups, looking for DENY rules
   • BCheck inbound and outbound Network ACL rules, looking for DENY rules
   • CReview the rejected packet reason codes in the VPC Flow Logs
   • DUse AWS X-Ray to trace the end-to-end application flow

   Show answer

   Answer: B

   Explanation

   For C - While VPC Flow Logs can provide insights into why packets are being rejected, this is a more detailed troubleshooting step. Checking the NACL rules is a more direct approach to identifying potential network layer issues.

   Source: Adapted from community discussion — DeadDropLabs

   Next question

9. Question 79 · 732 in bank

   Select 2

   The Development team receives an error message each time the team members attempt to encrypt or decrypt a Secure String parameter from the SSM Parameter Store by using an AWS KMS customer managed key (CMK). Which CMK-related issues could be responsible? (Choose two.)

   • AThe CMK specified in the application does not exist.
   • BThe CMK specified in the application is currently in use.
   • CThe CMK specified in the application is using the CMK KeyID instead of CMK Amazon Resource Name.
   • DThe CMK specified in the application is not enabled.
   • EThe CMK specified in the application is using an alias.

   Show answer

   Answer: AD

   Next question

10. Question 80 · 732 in bank

    Select 3

    A company has an application that needs to get objects from an Amazon S3 bucket. The application runs on Amazon EC2 instances. All the objects in the S3 bucket are encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The resources in the VPC do not have access to the internet and use a gateway VPC endpoint to access Amazon S3. The company discovers that the application is unable to get objects from the S3 bucket. Which factors could cause this issue? (Choose three.)

    • AThe IAM instance profile that is attached to the EC2 instances does not allow the s3:ListBucket action for the S3 bucket.
    • BThe IAM instance profile that is attached to the EC2 instances does not allow the s3:ListParts action for the S3 bucket.
    • CThe KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:ListKeys action to the EC2 instance profile ARN.
    • DThe KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:Decrypt action to the EC2 instance profile ARN.
    • EThe S3 bucket policy does not allow access from the gateway VPC endpoint.
    • FThe security group that is attached to the EC2 instances is missing an inbound rule from the S3 managed prefix list over port 443.

    Show answer

    Answer: ADE

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C02 practice, question 71. 732 questions available.