SCS-C03 practice questions 51–60

1. Question 51 · 79 in bank

   Select 3

   A company uses AWS IAM Identity Center to manage access to its AWS accounts. The accounts are in an organization in AWS Organizations. A security engineer needs to set up delegated administration of IAM Identity Center in the organization's management account. Which combination of steps should the security engineer perform in IAM Identity Center before configuring delegated administration? (Choose three.)

   • AGrant least privilege access to the organization's management account.
   • BCreate a new IAM Identity Center directory in the organization's management account.
   • CSet up a second AWS Region in the organization's management account.
   • DCreate permission sets for use only in the organization's management account.
   • ECreate IAM users for use only in the organization's management account.
   • FCreate user assignments only in the organization’s management account.

   Show answer

   Answer: ADF

   Next question

2. Question 52 · 79 in bank

   Select 3

   A company finds that one of its Amazon EC2 instances suddenly has a high CPU usage. The company does not know whether the EC2 instance is compromised or whether the operating system is performing background cleanup. Which combination of steps should a security engineer take before investigating the issue? (Choose three.)

   • ADisable termination protection for the EC2 instance if termination protection has not been disabled.
   • BEnable termination protection for the EC2 instance if termination protection has not been enabled.
   • CTake snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance.
   • DRemove all snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance.
   • ECapture the EC2 instance metadata, and then tag the EC2 instance as under quarantine.
   • FImmediately remove any entries in the EC2 instance metadata that contain sensitive information.

   Show answer

   Answer: BCE

   Next question

3. Question 53 · 79 in bank

   A company's security engineer is designing an isolation procedure for Amazon EC2 instances as part of an incident response plan. The security engineer needs to isolate a target instance to block any traffic to and from the target instance, except for traffic from the company's forensics team. Each of the company's EC2 instances has its own dedicated security group. The EC2 instances are deployed in subnets of a VPC. A subnet can contain multiple instances. The security engineer is testing the procedure for EC2 isolation and opens an SSH session to the target instance. The procedure starts to simulate access to the target instance by an attacker. The security engineer removes the existing security group rules and adds security group rules to give the forensics team access to the target instance on port 22. After these changes, the security engineer notices that the SSH connection is still active and usable. When the security engineer runs a ping command to the public IP address of the target instance, the ping command is blocked. What should the security engineer do to isolate the target instance?

   • AAdd an inbound rule to the security group to allow traffic from 0.0.0.0/0 for all ports. Add an outbound rule to the security group to allow traffic to 0.0.0.0/0 for all ports. Then immediately delete these rules.
   • BRemove the port 22 security group rule. Attach an instance role policy that allows AWS Systems Manager Session Manager connections so that the forensics team can access the target instance.
   • CCreate a network ACL that is associated with the target instance's subnet. Add a rule at the top of the inbound rule set to deny all traffic from 0.0.0.0/0. Add a rule at the top of the outbound rule set to deny all traffic to 0.0.0.0/0.
   • DCreate an AWS Systems Manager document that adds a host-level firewall rule to block all inbound traffic and outbound traffic. Run the document on the target instance.

   Show answer

   Answer: C

   Next question

4. Question 54 · 79 in bank

   A company that uses AWS Organizations is using AWS IAM Identity Center (AWS Single Sign-On) to administer access to AWS accounts. A security engineer is creating a custom permission set in IAM Identity Center. The company will use the permission set across multiple accounts. An AWS managed policy and a customer managed policy are attached to the permission set. The security engineer has full administrative permissions and is operating in the management account. When the security engineer attempts to assign the permission set to an IAM Identity Center user who has access to multiple accounts, the assignment fails. What should the security engineer do to resolve this failure?

   • ACreate the customer managed policy in every account where the permission set is assigned. Give the customer managed policy the same name and same permissions in each account.
   • BRemove either the AWS managed policy or the customer managed policy from the permission set. Create a second permission set that includes the removed policy. Apply the permission sets separately to the user.
   • CEvaluate the logic of the AWS managed policy and the customer managed policy. Resolve any policy conflicts in the permission set before deployment.
   • DDo not add the new permission set to the user. Instead, edit the user's existing permission set to include the AWS managed policy and the customer managed policy.

   Show answer

   Answer: A

   Next question

5. Question 55 · 79 in bank

   An IAM user receives an Access Denied message when the user attempts to access objects in an Amazon S3 bucket. The user and the S3 bucket are in the same AWS account. The S3 bucket is configured to use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt all of its objects at rest by using a customer managed key from the same AWS account. The S3 bucket has no bucket policy defined. The IAM user has been granted permissions through an IAM policy that allows the kms:Decrypt permission to the customer managed key. The IAM policy also allows the s3:List* and s3:Get* permissions for the S3 bucket and its objects. Which of the following is a possible reason that the IAM user cannot access the objects in the S3 bucket?

   • AThe IAM policy needs to allow the kms:DescribeKey permission.
   • BThe S3 bucket has been changed to use the AWS managed key to encrypt objects at rest.
   • CAn S3 bucket policy needs to be added to allow the IAM user to access the objects.
   • DThe KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.

   Show answer

   Answer: D

   Next question

6. Question 56 · 79 in bank

   A company runs workloads in the us-east-1 Region. The company has never deployed resources to other AWS Regions and does not have any multi-Region resources. The company needs to replicate its workloads and infrastructure to the us-west-1 Region. A security engineer must implement a solution that uses AWS Secrets Manager to store secrets in both Regions. The solution must use AWS Key Management Service (AWS KMS) to encrypt the secrets. The solution must minimize latency and must be able to work if only one Region is available. The security engineer uses Secrets Manager to create the secrets in us-east-1. What should the security engineer do next to meet the requirements?

   • AEncrypt the secrets in us-east-1 by using an AWS managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using a new AWS managed KMS key in us-west-1.
   • BEncrypt the secrets in us-east-1 by using an AWS managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1.
   • CEncrypt the secrets in us-east-1 by using a customer managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1.
   • DEncrypt the secrets in us-east-1 by using a customer managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using the customer managed KMS key from us-east-1.

   Show answer

   Answer: A

   Next question

7. Question 57 · 79 in bank

   A company runs workloads in an AWS account. A security engineer observes some unusual findings in Amazon GuardDuty. The security engineer wants to investigate a specific IAM role and generate an investigation report. The report must contain details about anomalous behavior and any indicators of compromise. Which solution will meet these requirements?

   • AUse Amazon Detective to perform an investigation on the IAM role.
   • BUse AWS Audit Manager to create an assessment. Specify the IAM role Run an assessment report.
   • CUse Amazon Inspector to create an assessment. Specify the IAM role. Run an assessment report.
   • DUse Amazon Inspector to run an on-demand scan of the IAM role.

   Show answer

   Answer: A

   Next question

8. Question 58 · 79 in bank

   Select 2

   A company recently set up Amazon GuardDuty and is receiving a high number of findings from IP addresses within the company. A security engineer has verified that these IP addresses are trusted and allowed. Which combination of steps should the security engineer take to configure GuardDuty so that it does not produce findings for these IP addresses? (Choose two.)

   • ACreate a plaintext configuration file that contains the trusted IP addresses.
   • BCreate a JSON configuration file that contains the trusted IP addresses.
   • CUpload the configuration file directly to GuardDuty.
   • DUpload the configuration file to Amazon S3. Add a new trusted IP list to GuardDuty that points to the file.
   • EManually copy and paste the configuration file data into the trusted IP list in GuardDuty.

   Show answer

   Answer: AD

   Next question

9. Question 59 · 79 in bank

   Select 2

   A development team is creating an open source toolset to manage a company's software as a service (SaaS) application. The company stores the code in a public repository so that anyone can view and download the toolset's code. The company discovers that the code contains an IAM access key and secret key that provide access to internal resources in the company’s AWS environment A security engineer must implement a solution to identify whether unauthorized usage of the exposed credentials has occurred. The solution also must prevent any additional usage of the exposed credentials. Which combination of steps will meet these requirements? (Choose two.)

   • AUse AWS Identity and Access Management Access Analyzer to determine which resources the exposed credentials accessed and who used them.
   • BDeactivate the exposed IAM access key from the user’s IAM account.
   • CCreate a rule in Amazon GuardDuty to block the access key in the source code from being used.
   • DCreate a new IAM access key and secret key for the user whose credentials were exposed.
   • EGenerate an IAM credential report. Check the report to determine when the user that owns the access key last logged in.

   Show answer

   Answer: BE

   Next question

10. Question 60 · 79 in bank

    A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket. The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client's own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company’s AWS resources. A security engineer creates a script that runs on the EC2 instance. The script uses the instance profile to generate an S3 presigned URL for the clients. Each presigned URL expires after 1 hour. Which additional step will meet these requirements?

    • AUpdate the S3 bucket policy to ensure that clients that use presigned URLs have the S3:Get* permission and the S3:List* permission to access S3 objects in the bucket.
    • BAdd a StringEquals condition to the IAM role policy for the EC2 instance profile. Configure the policy condition to restrict access based on the s3:ResourceTag/ClientId tag of each invoice. Tag each generated invoice with the ID of its corresponding client.
    • CUpdate the script to use AWS Security Token Service (AWS STS) to obtain new credentials each time the script runs by assuming a new role that has S3 GetObject permissions. Use the credentials to generate the presigned URLs.
    • DGenerate an access key and a secret key for an IAM user that has S3:GetObject permissions on the S3 bucket. Embed the keys into the script. Use the keys to generate the presigned URLs.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C03 practice, question 51. 79 questions available.