🔍

SCS-C02 — questions

Page 10 of 16 · 307 total questions.

SCS-C02 Question 181

Single page →
Topic 1 · Question 181

A company deployed an Amazon EC2 instance to a VPC on AWS. A recent alert indicates that the EC2 instance is receiving a suspicious number of requests over an open TCP port from an external source. The TCP port remains open for long periods of time. The company's security team needs to stop all activity to this port from the external source to ensure that the EC2 instance is not being compromised. The application must remain available to other users. Which solution will meet these requirements?

  • AUpdate the network ACL that is attached to the subnet that is associated with the EC2 instance. Add a Deny statement for the port and the source IP addresses. (correct answer)
  • BUpdate the elastic network interface security group that is attached to the EC2 instance to remove the port from the inbound rule list.
  • CUpdate the elastic network interface security group that is attached to the EC2 instance by adding a Deny entry in the inbound list for the port and the source IP addresses.
  • DCreate a new network ACL for the subnet. Deny all traffic from the EC2 instance to prevent data from being removed.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Update the network ACL that is attached to the subnet that is associated with the EC2 instance. Add a Deny statement for the port and the source IP addresses.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SCS-C02 Question 182

Single page →
Topic 1 · Question 182 · Select all that apply

A company has secured the AWS account root user for its AWS account by following AWS best practices. The company also has enabled AWS CloudTrail, which is sending its logs to Amazon S3. A security engineer wants to receive notification in near-real time if a user uses the AWS account root user credentials to sign in to the AWS Management Console Which solutions will provide this notification? (Choose two.)

  • AUse AWS Trusted Advisor and its security evaluations for the root account. Configure an Amazon EventBridge event rule that is invoked by the Trusted Advisor API. Configure the rule to target an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe any required endpoints to the SNS topic so that these endpoints can receive notification.
  • BUse AWS IAM Access Analyzer. Create an Amazon Cloud Watch Logs metric filter to evaluate log entries from Access Analyzer that detect a successful root account login. Create an Amazon CloudWatch alarm that monitors whether a root login has occurred. Configure the CloudWatch alarm to notify an Amazon Simple Notification Service (Amazon SNS) topic when the alarm enters the ALARM state. Subscribe any required endpoints to this SNS topic so that these endpoints can receive notification.
  • CConfigure AWS CloudTrail to send its logs to Amazon CloudWatch Logs. Configure a metric filter on the CloudWatch Logs log group used by CloudTrail to evaluate log entries for successful root account logins. Create an Amazon CloudWatch alarm that monitors whether a root login has occurred. Configure the CloudWatch alarm to notify an Amazon Simple Notification Service (Amazon SNS) topic when the alarm enters the ALARM state. Subscribe any required endpoints to this SNS topic so that these endpoints can receive notification. (correct answer)
  • DConfigure AWS CloudTrail to send log notifications to an Amazon Simple Notification Service (Amazon SNS) topic. Create an AWS Lambda function that parses the CloudTrail notification for root login activity and notifies a separate SNS topic that contains the endpoints that should receive notification. Subscribe the Lambda function to the SNS topic that is receiving log notifications from CloudTrail.
  • EConfigure an Amazon EventBridge event rule that runs when Amazon CloudWatch API calls are recorded for a successful root login. Configure the rule to target an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe any required endpoints to the SNS topic so that these endpoints can receive notification. (correct answer)
Reveal answer & explanation
Correct answer: C, E

The correct answer is C, E. Option C: Configure AWS CloudTrail to send its logs to Amazon CloudWatch Logs. Configure a metric filter on the CloudWatch Logs log group used by CloudTrail to evaluate log entries for successful root account logins. Create an... Option E: Configure an Amazon EventBridge event rule that runs when Amazon CloudWatch API calls are recorded for a successful root login. Configure the rule to target an Amazon Simple Notification Service (Amazon SNS) topic. Su...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. This option meets the real-time / low-latency performance requirement.

SCS-C02 Question 183

Single page →
Topic 1 · Question 183 · Select all that apply

A company has AWS accounts that are in an organization in AWS Organizations. A security engineer needs to set up AWS Security Hub in a dedicated account for security monitoring. The security engineer must ensure that Security Hub automatically manages all existing accounts and all new accounts that are added to the organization. Security Hub also must receive findings from all AWS Regions. Which combination of actions will meet these requirements with the LEAST operational overhead? (Choose two.)

  • AConfigure a finding aggregation Region for Security Hub. Link the other Regions to the aggregation Region. (correct answer)
  • BCreate an AWS Lambda function that routes events from other Regions to the dedicated Security Hub account. Create an Amazon EventBridge rule to invoke the Lambda function.
  • CTurn on the option to automatically enable accounts for Security Hub. (correct answer)
  • DCreate an SCP that denies the securityhub:DisableSecurityHub permission. Attach the SCP to the organization’s root account.
  • EConfigure services in other Regions to write events to an AWS CloudTrail organization trail. Configure Security Hub to read events from the trail.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Configure a finding aggregation Region for Security Hub. Link the other Regions to the aggregation Region. Option C: Turn on the option to automatically enable accounts for Security Hub.

Explanation

AWS Security Hub centralizes security findings and compliance checks. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 184

Single page →
Topic 1 · Question 184

A security engineer is implementing a solution to allow users to seamlessly encrypt Amazon S3 objects without having to touch the keys directly. The solution must be highly scalable without requiring continual management. Additionally, the organization must be able to immediately delete the encryption keys. Which solution meets these requirements?

  • AUse AWS KMS with AWS managed keys and the ScheduleKeyDeletion API with a PendingWindowInDays set to 0 to remove the keys if necessary.
  • BUse KMS with AWS imported key material and then use the DeleteImportedKeyMaterial API to remove the key material if necessary. (correct answer)
  • CUse AWS CloudHSM to store the keys and then use the CloudHSM API or the PKCS11 library to delete the keys if necessary.
  • DUse the Systems Manager Parameter Store to store the keys and then use the service API operations to delete the keys if necessary.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use KMS with AWS imported key material and then use the DeleteImportedKeyMaterial API to remove the key material if necessary.

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SCS-C02 Question 185

Single page →
Topic 1 · Question 185

A company needs to implement DNS Security Extensions (DNSSEC) for a specific subdomain. The subdomain is already registered with Amazon Route 53. A security engineer has enabled DNSSEC signing and has created a key-signing key (KSK). When the security engineer tries to test the configuration, the security engineer receives an error for a broken trust chain. What should the security engineer do to resolve this error?

  • AReplace the KSK with a zone-signing key (ZSK).
  • BDeactivate and then activate the KSK.
  • CCreate a Delegation Signer (DS) record in the parent hosted zone. (correct answer)
  • DCreate a Delegation Signer (DS) record in the subdomain.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a Delegation Signer (DS) record in the parent hosted zone.

SCS-C02 Question 186

Single page →
Topic 1 · Question 186

A company used AWS Organizations to set up an environment with multiple AWS accounts. The company's organization currently has two AWS accounts, and the company expects to add more than 50 AWS accounts during the next 12 months. The company will require all existing and future AWS accounts to use Amazon GuardDuty. Each existing AWS account has GuardDuty active. The company reviews GuardDuty findings by logging into each AWS account individually. The company wants a centralized view of the GuardDuty findings for the existing AWS accounts and any future AWS accounts. The company also must ensure that any new AWS account has GuardDuty automatically turned on. Which solution will meet these requirements?

  • AEnable AWS Security Hub in the organization's management account. Configure GuardDuty within the management account to send all GuardDuty findings to Security Hub.
  • BCreate a new AWS account in the organization. Enable GuardDuty in the new account. Designate the new account as the delegated administrator account for GuardDuty. Configure GuardDuty to add existing accounts as member accounts. Select the option to automatically add new AWS accounts to the organization. (correct answer)
  • CCreate a new AWS account in the organization. Enable GuardDuty in the new account. Enable AWS Security Hub in each account. Select the option to automatically add new AWS accounts to the organization.
  • DEnable AWS Security Hub in the organization's management account. Designate the management account as the delegated administrator account for Security Hub. Add existing accounts as member accounts. Select the option to automatically add new AWS accounts to the organization. Send all Security Hub findings to the organization's GuardDuty account.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a new AWS account in the organization. Enable GuardDuty in the new account. Designate the new account as the delegated administrator account for GuardDuty. Configure GuardDuty to add existing accounts as member...

Explanation

Amazon GuardDuty continuously monitors for threats and malicious activity. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 187

Single page →
Topic 1 · Question 187

A company wants to remove all SSH keys permanently from a specific subset of its Amazon Linux 2 Amazon EC2 instances that are using the same IAM instance profile. However, three individuals who have IAM user accounts will need to access these instances by using an SSH session to perform critical duties. How can a security engineer provide the access to meet these requirements?

  • AAssign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager. Provide the IAM user accounts with permission to use Systems Manager. Remove the SSH keys from the EC2 instances. Use Systems Manager Inventory to select the EC2 instance and connect.
  • BAssign an IAM policy to the IAM user accounts to provide permission to use AWS Systems Manager Run Command. Remove the SSH keys from the EC2 instances. Use Run Command to open an SSH connection to the EC2 instance.
  • CAssign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager. Provide the IAM user accounts with permission to use Systems Manager. Remove the SSH keys from the EC2 instances. Use Systems Manager Session Manager to select the EC2 instance and connect. (correct answer)
  • DAssign an IAM policy to the IAM user accounts to provide permission to use the EC2 service in the AWS Management Console. Remove the SSH keys from the EC2 instances. Connect to the EC2 instance as the ec2-user through the AWS Management Console’s EC2 SSH client method.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager. Provide the IAM user accounts with permission to use Systems Manager. Remove the SSH keys from the EC2 inst...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Systems Manager operates and automates management of fleets of resources.

SCS-C02 Question 188

Single page →
Topic 1 · Question 188

A company is storing data in Amazon S3 Glacier. A security engineer implemented a new vault lock policy for 10 TB of data and called the initiate-vault-lock operation 12 hours ago. The audit team identified a typo in the policy that is allowing unintended access to the vault. What is the MOST cost-effective way to correct this error?

  • ACall the abort-vault-lock operation. Update the policy. Call the initiate-vault-lock operation again. (correct answer)
  • BCopy the vault data to a new S3 bucket. Delete the vault Create a new vault with the data.
  • CUpdate the policy to keep the vault lock in place.
  • DUpdate the policy. Call the initiate-vault-lock operation again to apply the new policy.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Call the abort-vault-lock operation. Update the policy. Call the initiate-vault-lock operation again. This option delivers the requirement at the lowest cost.

SCS-C02 Question 189

Single page →
Topic 1 · Question 189

A company uses HTTP Live Streaming (HLS) to stream live video content to paying subscribers by using Amazon CloudFront. HLS splits the video content into chunks so that the user can request the right chunk based on different conditions. Because the video events last for several hours, the total video is made up of thousands of chunks. The origin URL is not disclosed, and every user is forced to access the CloudFront URL. The company has a web application that authenticates the paying users against an internal repository and a CloudFront key pair that is already issued. What is the simplest and MOST effective way to protect the content?

  • ADevelop the application to use the CloudFront key pair to create signed URLs that users will use to access the content.
  • BDevelop the application to use the CloudFront key pair to set the signed cookies that users will use to access the content. (correct answer)
  • CDevelop the application to issue a security token that Lambda@Edge will receive to authenticate and authorize access to the content.
  • DKeep the CloudFront URL encrypted inside the application, and use AWS KMS to resolve the URL on-the-fly after the user is authenticated.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Develop the application to use the CloudFront key pair to set the signed cookies that users will use to access the content.

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins. This option meets the real-time / low-latency performance requirement.

SCS-C02 Question 190

Single page →
Topic 1 · Question 190

A company runs workloads in the us-east-1 Region. The company has never deployed resources to other AWS Regions and does not have any multi-Region resources. The company needs to replicate its workloads and infrastructure to the us-west-1 Region. A security engineer must implement a solution that uses AWS Secrets Manager to store secrets in both Regions. The solution must use AWS Key Management Service (AWS KMS) to encrypt the secrets. The solution must minimize latency and must be able to work if only one Region is available. The security engineer uses Secrets Manager to create the secrets in us-east-1. What should the security engineer do next to meet the requirements?

  • AEncrypt the secrets in us-east-1 by using an AWS managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using a new AWS managed KMS key in us-west-1.
  • BEncrypt the secrets in us-east-1 by using an AWS managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1.
  • CEncrypt the secrets in us-east-1 by using a customer managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1.
  • DEncrypt the secrets in us-east-1 by using a customer managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using the customer managed KMS key from us-east-1. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Encrypt the secrets in us-east-1 by using a customer managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using the customer managed KMS key from us-east-1.

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SCS-C02 Question 191

Single page →
Topic 1 · Question 191

A company operates a web application that runs on Amazon EC2 instances. The application listens on port 80 and port 443. The company uses an Application Load Balancer (ALB) with AWS WAF to terminate SSL and to forward traffic to the application instances only on port 80. The ALB is in public subnets that are associated with a network ACL that is named NACL1. The application instances are in dedicated private subnets that are associated with a network ACL that is named NACL2. An Amazon RDS for PostgreSQL DB instance that uses port 5432 is in a dedicated private subnet that is associated with a network ACL that is named NACL3. All the network ACLs currently allow all inbound and outbound traffic. Which set of network ACL changes will increase the security of the application while ensuring functionality?

  • AMake the following changes to NACL3: • Add a rule that allows inbound traffic on port 5432 from NACL2. • Add a rule that allows outbound traffic on ports 1024-65536 to NACL2. • Remove the default rules that allow all inbound and outbound traffic.
  • BMake the following changes to NACL3: • Add a rule that allows inbound traffic on port 5432 from the Cl DR blocks of the application instance subnets. • Add a rule that allows outbound traffic on ports 1024-65536 to the application instance subnets. • Remove the default rules that allow all inbound and outbound traffic. (correct answer)
  • CMake the following changes to NACL2: • Add a rule that allows outbound traffic on port 5432 to the CIDR blocks of the RDS subnets. • Remove the default rules that allow all inbound and outbound traffic.
  • DMake the following changes to NACL2: • Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the RDS subnets. • Add a rule that allows outbound traffic on port 5432 to the RDS subnets.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Make the following changes to NACL3: • Add a rule that allows inbound traffic on port 5432 from the Cl DR blocks of the application instance subnets. • Add a rule that allows outbound traffic on ports 1024-65536 to th...

SCS-C02 Question 192

Single page →
Topic 1 · Question 192 · Select all that apply

AWS CloudTrail is being used to monitor API calls in an organization. An audit revealed that CloudTrail is failing to deliver events to Amazon S3 as expected. What initial actions should be taken to allow delivery of CloudTrail events to S3? (Choose two.)

  • AVerify that the S3 bucket policy allows CloudTrail to write objects. (correct answer)
  • BVerify that the IAM role used by CloudTrail has access to write to Amazon CloudWatch Logs.
  • CRemove any lifecycle policies on the S3 bucket that are archiving objects to S3 Glacier Flexible Retrieval.
  • DVerify that the S3 bucket defined in CloudTrail exists. (correct answer)
  • EVerify that the log file prefix defined in CloudTrail exists in the S3 bucket.
Reveal answer & explanation
Correct answer: A, D

The correct answer is A, D. Option A: Verify that the S3 bucket policy allows CloudTrail to write objects. Option D: Verify that the S3 bucket defined in CloudTrail exists.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS CloudTrail records API activity for auditing and governance.

SCS-C02 Question 193

Single page →
Topic 1 · Question 193

A company has public certificates that are managed by AWS Certificate Manager (ACM). The certificates are either imported certificates or managed certificates from ACM with mixed validation methods. A security engineer needs to design a monitoring solution to provide alerts by email when a certificate is approaching its expiration date. What is the MOST operationally efficient way to meet this requirement?

  • ACreate an AWS Lambda function to list all certificates and to go through each certificate to describe the certificate by using the AWS SDK. Filter on the NotAfter attribute and send an email notification. Use an Amazon EventBridge rate expression to schedule the Lambda function to run daily.
  • BCreate an Amazon CloudWatch alarm. Add all the certificate ARNs in the AWS/CertificateManager namespace to the DaysToExpiry metric. Configure the alarm to publish a notification to an Amazon Simple Notification Service (Amazon SNS) topic when the value for the DaysToExpiry metric is less than or equal to 31.
  • CSet up AWS Security Hub. Turn on the AWS Foundational Security Best Practices standard with integrated ACM to send findings. Configure and use a custom action by creating a rule to match the pattern from the ACM findings on the NotBefore attribute as the event source. Create an Amazon Simple Notification Service (Amazon SNS) topic as the target.
  • DCreate an Amazon EventBridge rule by using a predefined pattern for ACM Choose the metric in the ACM Certificate Approaching Expiration event as the event pattern. Create an Amazon Simple Notification Service (Amazon SNS) topic as the target. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create an Amazon EventBridge rule by using a predefined pattern for ACM Choose the metric in the ACM Certificate Approaching Expiration event as the event pattern. Create an Amazon Simple Notification Service (Amazon...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Certificate Manager provisions and renews TLS certificates automatically.

SCS-C02 Question 194

Single page →
Topic 1 · Question 194

A security team is responsible for reviewing AWS API call activity in the cloud environment for security violations. These events must be recorded and retained in a centralized location for both current and future AWS regions. What is the SIMPLEST way to meet these requirements?

  • AEnable AWS Trusted Advisor security checks in the AWS Console, and report all security incidents for all regions.
  • BEnable AWS CloudTrail by creating individual trails for each region, and specify a single Amazon S3 bucket to receive log files for later analysis.
  • CEnable AWS CloudTrail by creating a new trail and applying the trail to all regions. Specify a single Amazon S3 bucket as the storage location. (correct answer)
  • DEnable Amazon CloudWatch logging for all AWS services across all regions, and aggregate them to a single Amazon S3 bucket for later analysis.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enable AWS CloudTrail by creating a new trail and applying the trail to all regions. Specify a single Amazon S3 bucket as the storage location.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS CloudTrail records API activity for auditing and governance.

SCS-C02 Question 195

Single page →
Topic 1 · Question 195

A company is running an application on Amazon EC2 instances in an Auto Scaling group. The application stores logs locally. A security engineer noticed that logs were lost after a scale-in event. The security engineer needs to recommend a solution to ensure the durability and availability of log data. All logs must be kept for a minimum of 1 year for auditing purposes. What should the security engineer recommend?

  • AWithin the Auto Scaling lifecycle, add a hook to create and attach an Amazon Elastic Block Store (Amazon EBS) log volume each time an EC2 instance is created. When the instance is terminated, the EBS volume can be reattached to another instance for log review.
  • BCreate an Amazon Elastic File System (Amazon EFS) file system and add a command in the user data section of the Auto Scaling launch template to mount the EFS file system during EC2 instance creation. Configure a process on the instance to copy the logs once a day from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory in the EFS file system.
  • CAdd an Amazon CloudWatch agent into the AMI used in the Auto Scaling group. Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review. (correct answer)
  • DWithin the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon Simple Notification Service (Amazon SNS). Configure the hook to remain in the Terminating:Wait state for 1 hour to allow manual review of the security logs prior to instance termination.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group. Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 196

Single page →
Topic 1 · Question 196

A company uses Amazon EC2 instances to host frontend services behind an Application Load Balancer. Amazon Elastic Block Store (Amazon EBS) volumes are attached to the EC2 instances. The company uses Amazon S3 buckets to store large files for images and music. The company has implemented a security architecture on AWS to prevent, identify, and isolate potential ransomware attacks. The company now wants to further reduce risk. A security engineer must develop a disaster recovery solution that can recover to normal operations if an attacker bypasses preventive and detective controls. The solution must meet an RPO of 1 hour. Which solution will meet these requirements?

  • AUse AWS Backup to create backups of the EC2 instances and S3 buckets every hour. Create AWS CloudFormation templates that replicate existing architecture components. Use AWS CodeCommit to store the CloudFormation templates alongside application configuration code. (correct answer)
  • BUse AWS Backup to create backups of the EBS volumes and S3 objects every day. Use Amazon Security Lake to create a centralized data lake for AWS CloudTrail logs and VPC flow logs. Use the logs for automated response.
  • CUse Amazon Security Lake to create a centralized data lake for AWS CloudTrail logs and VPC flow logs. Use the logs for automated response. Enable AWS Security Hub to establish a single location for recovery procedures. Create AWS CloudFormation templates that replicate existing architecture components. Use AWS CodeCommit to store the CloudFormation templates alongside application configuration code.
  • DCreate EBS snapshots every 4 hours. Enable Amazon GuardDuty Malware Protection. Create automation to immediately restore the most recent snapshot for any EC2 instances that produce an Execution:EC2/MaliciousFile finding in GuardDuty.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use AWS Backup to create backups of the EC2 instances and S3 buckets every hour. Create AWS CloudFormation templates that replicate existing architecture components. Use AWS CodeCommit to store the CloudFormation temp...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon S3 provides durable, scalable object storage that is fully managed. AWS Backup centrally automates and manages backups across AWS services. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SCS-C02 Question 197

Single page →
Topic 1 · Question 197

A company has an application that runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances are in an Amazon EC2 Auto Scaling group and are attached to Amazon Elastic Block Store (Amazon EBS) volumes. A security engineer needs to preserve all forensic evidence from one of the instances. Which order of steps should the security engineer use to meet this requirement?

  • ATake an EBS volume snapshot of the instance and store the snapshot in an Amazon S3 bucket. Take a memory snapshot of the instance and store the snapshot in an S3 bucket Detach the instance from the Auto Scaling group. Deregister the instance from the ALB. Stop the instance.
  • BTake a memory snapshot of the instance and store the snapshot in an Amazon S3 bucket. Stop the instance. Take an EBS volume snapshot of the instance and store the snapshot in an S3 bucket. Detach the instance from the Auto Scaling group. Deregister the instance from the ALB.
  • CDetach the instance from the Auto Scaling group. Deregister the instance from the ALB. Take an EBS volume snapshot of the instance and store the snapshot in an Amazon S3 bucket. Take a memory snapshot of the instance and store the snapshot in an S3 bucket. Stop the instance. (correct answer)
  • DDetach the instance from the Auto Scaling group. Deregister the instance from the ALB Stop the instance. Take a memory snapshot of the instance and store the snapshot in an Amazon S3 bucket. Take an EBS volume snapshot of the instance and store the snapshot in an S3 bucket.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Detach the instance from the Auto Scaling group. Deregister the instance from the ALB. Take an EBS volume snapshot of the instance and store the snapshot in an Amazon S3 bucket. Take a memory snapshot of the instance...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon EBS provides block storage attached to a single EC2 instance.

SCS-C02 Question 198

Single page →
Topic 1 · Question 198 · Select all that apply

An application team wants to use AWS Certificate Manager (ACM) to request public certificates to ensure that data is secured in transit. The domains that are being used are not currently hosted on Amazon Route 53. The application team wants to use an AWS managed distribution and caching solution to optimize requests to its systems and provide better points of presence to customers. The distribution solution will use a primary domain name that is customized. The distribution solution also will use several alternative domain names. The certificates must renew automatically over an indefinite period of time. Which combination of steps should the application team take to deploy this architecture? (Choose three.)

  • ARequest a certificate from ACM in the us-west-2 Region. Add the domain names that the certificate will secure.
  • BSend an email message to the domain administrators to request validation of the domains for ACM.
  • CRequest validation of the domains for ACM through DNS. Insert CNAME records into each domain's DNS zone. (correct answer)
  • DCreate an Application Load Balancer for the caching solution. Select the newly requested certificate from ACM to be used for secure connections.
  • ECreate an Amazon CloudFront distribution for the caching solution. Enter the main CNAME record as the Origin Name. Enter the subdomain names or alternate names in the Alternate Domain Names Distribution Settings. Select the newly requested certificate from ACM to be used for secure connections. (correct answer)
  • FRequest a certificate from ACM in the us-east-1 Region. Add the domain names that the certificate will secure. (correct answer)
Reveal answer & explanation
Correct answer: C, E, F

The correct answer is C, E, F. Option C: Request validation of the domains for ACM through DNS. Insert CNAME records into each domain's DNS zone. Option E: Create an Amazon CloudFront distribution for the caching solution. Enter the main CNAME record as the Origin Name. Enter the subdomain names or alternate names in the Alternate Domain Names Distribution Settings. Sele... Option F: Request a certificate from ACM in the us-east-1 Region. Add the domain names that the certificate will secure.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS Certificate Manager provisions and renews TLS certificates automatically.

SCS-C02 Question 199

Single page →
Topic 1 · Question 199

A company’s security engineer wants to receive an email alert whenever Amazon GuardDuty, AWS Identity and Access Management Access Analyzer, or Amazon Macie generate a high-severity security finding. The company uses AWS Control Tower to govern all of its accounts. The company also uses AWS Security Hub with all of the AWS service integrations turned on. Which solution will meet these requirements with the LEAST operational overhead?

  • ASet up separate AWS Lambda functions for GuardDuty, IAM Access Analyzer, and Macie to call each service's public API to retrieve high-severity findings. Use Amazon Simple Notification Service (Amazon SNS) to send the email alerts. Create an Amazon EventBridge rule to invoke the functions on a schedule.
  • BCreate an Amazon EventBridge rule with a pattern that matches Security Hub findings events with high severity. Configure the rule to send the findings to a target Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the desired email addresses to the SNS topic. (correct answer)
  • CCreate an Amazon EventBridge rule with a pattern that matches AWS Control Tower events with high severity. Configure the rule to send the findings to a target Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the desired email addresses to the SNS topic.
  • DHost an application on Amazon EC2 to call the GuardDuty. IAM Access Analyzer, and Macie APIs. Within the application, use the Amazon Simple Notification Service (Amazon SNS) API to retrieve high-severity findings and to send the findings to an SNS topic. Subscribe the desired email addresses to the SNS topic.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Amazon EventBridge rule with a pattern that matches Security Hub findings events with high severity. Configure the rule to send the findings to a target Amazon Simple Notification Service (Amazon SNS) topic....

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Security Hub centralizes security findings and compliance checks.

SCS-C02 Question 200

Single page →
Topic 1 · Question 200 · Select all that apply

A company hosts an application on Amazon EC2 instances. The application also uses Amazon S3 and Amazon Simple Queue Service (Amazon SQS). The application is behind an Application Load Balancer (ALB) and scales with AWS Auto Scaling. The company's security policy requires the use of least privilege access, which has been applied to all existing AWS resources. A security engineer needs to implement private connectivity to AWS services. Which combination of steps should the security engineer take to meet this requirement? (Choose three.)

  • AUse an interface VPC endpoint for Amazon SQS. (correct answer)
  • BConfigure a connection to Amazon S3 through AWS Transit Gateway.
  • CUse a gateway VPC endpoint for Amazon S3. (correct answer)
  • DModify the IAM role applied to the EC2 instances in the Auto Scaling group to allow outbound traffic to the interface endpoints.
  • EModify the endpoint policies on all VPC endpoints. Specify the SQS and S3 resources that the application uses. (correct answer)
  • FConfigure a connection to Amazon S3 through AWS Firewall Manager.
Reveal answer & explanation
Correct answer: A, C, E

The correct answer is A, C, E. Option A: Use an interface VPC endpoint for Amazon SQS. Option C: Use a gateway VPC endpoint for Amazon S3. Option E: Modify the endpoint policies on all VPC endpoints. Specify the SQS and S3 resources that the application uses.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. A gateway VPC endpoint gives private, no-cost access to Amazon S3 and DynamoDB from within the VPC. A VPC endpoint provides private connectivity to AWS services without traversing the public internet.

Showing questions 181–200 of 307 · Page 10 of 16