🔍

SCS-C02 — questions

Page 7 of 16 · 307 total questions.

SCS-C02 Question 121

Single page →
Topic 1 · Question 121 · Select all that apply

A company uses SAML federation with AWS Identity and Access Management (IAM) to provide internal users with SSO for their AWS accounts. The company's identity provider certificate was rotated as part of its normal lifecycle Shortly after users started receiving the following error when attempting to log in: “Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken)” A security engineer needs to address the immediate issue and ensure that it will not occur again. Which combination of steps should the security engineer take to accomplish this? (Choose two.)

  • ADownload a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity.
  • BDuring the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required. (correct answer)
  • CDownload a new copy of the SAML metadata file from the identity provider. Upload the new metadata to the IAM identity provider entity configured for the SAML integration in question. (correct answer)
  • DDuring the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new copy of the metadata file and create a new IAM identity provider entity. Upload the metadata file to the new IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
  • EDownload a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity. Update the identity provider configurations to pass a new IAM identity provider entity name in the SAML assertion.
Reveal answer & explanation
Correct answer: B, C

The correct answer is B, C. Option B: During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new metadata file and upload it to the IAM identity p... Option C: Download a new copy of the SAML metadata file from the identity provider. Upload the new metadata to the IAM identity provider entity configured for the SAML integration in question.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 122

Single page →
Topic 1 · Question 122

A company is implementing a new application in a new AWS account. A VPC and subnets have been created for the application. The application has been peered to an existing VPC in another account in the same AWS Region for database access Amazon EC2 instances will regularly be created and terminated in the application VPC, but only some of them will need access to the databases in the peered VPC over TCP port 1521. A security engineer must ensure that only the EC2 instances that need access to the databases can access them through the network. How can the security engineer implement this solution?

  • ACreate a new security group in the database VPC and create an inbound rule that allows all traffic from the IP address range of the application VPC. Add a new network ACL rule on the database subnets. Configure the rule to TCP port 1521 from the IP address range of the application VPC. Attach the new security group to the database instances that the application instances need to access.
  • BCreate a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Create a new security group in the database VPC with an inbound rule that allows the IP address range of the application VPC over port 1521. Attach the new security group to the database instances and the application instances that need database access.
  • CCreate a new security group in the application VPC with no inbound rules. Create a new security group in the database VPC with an inbound rule that allows TCP port 1521 from the new application security group in the application VPAttach the application security group to the application instances that need database access and attach the database security group to the database instances. (correct answer)
  • DCreate a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Add a new network ACL rule on the database subnets. Configure the rule to allow all traffic from the IP address range of the application VPC. Attach the new security group to the application instances that need database access.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a new security group in the application VPC with no inbound rules. Create a new security group in the database VPC with an inbound rule that allows TCP port 1521 from the new application security group in the a...

SCS-C02 Question 123

Single page →
Topic 1 · Question 123 · Select all that apply

A company needs a forensic-logging solution for hundreds of applications running in Docker on Amazon EC2. The solution must perform real-time analytics on the logs, must support the replay of messages, and must persist the logs. Which AWS services should be used to meet these requirements? (Choose two.)

  • AAmazon Athena
  • BAmazon Kinesis (correct answer)
  • CAmazon SQS
  • DAmazon OpenSearch Service (correct answer)
  • EAmazon EMR
Reveal answer & explanation
Correct answer: B, D

The correct answer is B, D. Option B: Amazon Kinesis Option D: Amazon OpenSearch Service

Explanation

Amazon Kinesis ingests and processes real-time streaming data at scale. Amazon OpenSearch Service provides managed search and log analytics. This option meets the real-time / low-latency performance requirement.

SCS-C02 Question 124

Single page →
Topic 1 · Question 124

A company has many member accounts in an organization in AWS Organizations. The company is concerned about the potential for misuse of the AWS account root user credentials for member accounts in the organization. To address this potential misuse, the company wants to ensure that even if the account root user credentials are compromised the account is still protected. Which solution will meet this requirement?

  • ABlock service access by using SCPs for the root user (correct answer)
  • BRemove the password for the root user
  • CDelete access keys for the root user
  • DCreate an Amazon EventBridge rule to detect any AWS account root user API events
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Block service access by using SCPs for the root user

Explanation

Service Control Policies set guardrails on what accounts in an organization can do.

SCS-C02 Question 125

Single page →
Topic 1 · Question 125

An Amazon EC2 Auto Scaling group launches Amazon Linux EC2 instances and installs the Amazon CloudWatch agent to publish logs to Amazon CloudWatch Logs. The EC2 instances launch with an IAM role that has an IAM policy attached. The policy provides access to publish custom metrics to CloudWatch. The EC2 instances run in a private subnet inside a VPC The VPC provides access to the internet for private subnets through a NAT gateway. A security engineer notices that no logs are being published to CloudWatch Logs for the EC2 instances that the Auto Scaling group launches. The security engineer validates that the CloudWatch Logs agent is running and is configured properly on the EC2 instances. In addition, the security engineer validates that network communications are working properly to AWS services. What can the security engineer do to ensure that the logs are published to CloudWatch Logs?

  • AConfigure the IAM policy in use by the IAM role to have access to the required cloudwatch: API actions that will publish logs. (correct answer)
  • BAdjust the Amazon EC2 Auto Scaling service-linked role to have permissions to write to CloudWatch Logs.
  • CConfigure the IAM policy in use by the IAM role to have access to the required AWS logs: API actions that will publish logs.
  • DAdd an interface VPC endpoint to provide a route to CloudWatch Logs.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Configure the IAM policy in use by the IAM role to have access to the required cloudwatch: API actions that will publish logs.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SCS-C02 Question 126

Single page →
Topic 1 · Question 126

A company uses Amazon Elastic Container Service (Amazon ECS) containers that have the Fargate launch type. The containers run web and mobile applications that are written in Java and Node.js. To meet network segmentation requirements, each of the company’s business units deploys applications in its own dedicated AWS account. Each business unit stores container images in an Amazon Elastic Container Registry (Amazon ECR) private registry in its own account. A security engineer must recommend a solution to scan ECS containers and ECR registries for vulnerabilities in operating systems and programming language libraries. The company’s audit team must be able to identify potential vulnerabilities that exist in any of the accounts where applications are deployed. Which solution will meet these requirements?

  • AIn each account, update the ECR registry to use Amazon Inspector instead of the default scanning service. Configure Amazon Inspector to forward vulnerability findings to AWS Security Hub in a central security account. Provide access for the audit team to use Security Hub to review the findings. (correct answer)
  • BIn each account, configure AWS Config to monitor the configuration of the ECS containers and the ECR registry. Configure AWS Config conformance packs for vulnerability scanning. Create an AWS Config aggregator in a central account to collect configuration and compliance details from all accounts. Provide the audit team with access to AWS Config in the account where the aggregator is configured.
  • CIn each account, configure AWS Audit Manager to scan the ECS containers and the ECR registry. Configure Audit Manager to forward vulnerability findings to AWS Security Hub in a central security account. Provide access for the audit team to use Security Hub to review the findings.
  • DIn each account, configure Amazon GuardDuty to scan the ECS containers and the ECR registry. Configure GuardDuty to forward vulnerability findings to AWS Security Hub in a central security account. Provide access for the audit team to use Security Hub to review the findings.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: In each account, update the ECR registry to use Amazon Inspector instead of the default scanning service. Configure Amazon Inspector to forward vulnerability findings to AWS Security Hub in a central security account....

Explanation

AWS Security Hub centralizes security findings and compliance checks. Amazon Inspector automatically scans workloads for software vulnerabilities. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 127

Single page →
Topic 1 · Question 127

A company uses Amazon EC2 Linux instances in the AWS Cloud. A member of the company’s security team recently received a report about common vulnerability identifiers on the instances. A security engineer needs to verify patching and perform remediation if the instances do not have the correct patches installed. The security engineer must determine which EC2 instances are at risk and must implement a solution to automatically update those instances with the applicable patches. What should the security engineer do to meet these requirements?

  • AUse AWS Systems Manager Patch Manager to view vulnerability identifiers for missing patches on the instances. Use Patch Manager also to automate the patching process. (correct answer)
  • BUse AWS Shield Advanced to view vulnerability identifiers for missing patches on the instances. Use AWS Systems Manager Patch Manager to automate the patching process.
  • CUse Amazon GuardDuty to view vulnerability identifiers for missing patches on the instances. Use Amazon inspector to automate the patching process.
  • DUse Amazon inspector to view vulnerability identifiers for missing patches on the instances. Use Amazon Inspector also to automate the patching process.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use AWS Systems Manager Patch Manager to view vulnerability identifiers for missing patches on the instances. Use Patch Manager also to automate the patching process.

Explanation

AWS Systems Manager operates and automates management of fleets of resources.

SCS-C02 Question 128

Single page →
Topic 1 · Question 128

A company hosts an application on Amazon EC2 that is subject to specific rules for regulatory compliance. One rule states that traffic to and from the workload must be inspected for network-level attacks. This involves inspecting the whole packet. To comply with this regulatory rule, a security engineer must install intrusion detection software on a c5n.4xlarge EC2 instance. The engineer must then configure the software to monitor traffic to and from the application instances. What should the security engineer do next?

  • APlace the network interface in promiscuous mode to capture the traffic
  • BConfigure VPC Flow Logs to send traffic to the monitoring EC2 instance using a Network Load Balancer.
  • CConfigure VPC traffic mirroring to send traffic to the monitoring EC2 instance using a Network Load Balancer. (correct answer)
  • DUse Amazon Inspector to detect network-level attacks and trigger an AWS Lambda function to send the suspicious packets to the EC2 instance.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure VPC traffic mirroring to send traffic to the monitoring EC2 instance using a Network Load Balancer.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. A Network Load Balancer handles very high throughput TCP/UDP traffic with ultra-low latency and static IPs. A load balancer distributes traffic across targets in multiple AZs for availability and scale.

SCS-C02 Question 129

Single page →
Topic 1 · Question 129

A company deploys a distributed web application on a fleet of Amazon EC2 instances. The fleet is behind an Application Load Balancer (ALB) that will be configured to terminate the TLS connection. All TLS traffic to the ALB must stay secure, even if the certificate private key is compromised. How can a security engineer meet this requirement?

  • ACreate an HTTPS listener that uses a certificate that is managed by AWS Certificate Manager (ACM).
  • BCreate an HTTPS listener that uses a security policy that uses a cipher suite with perfect forward secrecy (PFS). (correct answer)
  • CCreate an HTTPS listener that uses the Server Order Preference security feature.
  • DCreate a TCP listener that uses a custom security policy that allows only cipher suites with perfect forward secrecy (PFS).
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an HTTPS listener that uses a security policy that uses a cipher suite with perfect forward secrecy (PFS).

SCS-C02 Question 130

Single page →
Topic 1 · Question 130

A company recently adopted new compliance standards that require all user actions in AWS to be logged. The user actions must be logged for all accounts that belong to an organization in AWS Organizations. The company needs to set alarms that respond when specified actions occur. The alarms must forward alerts to an email distribution list. The alerts must occur in as close to real time as possible. Which solution will meet these requirements?

  • AImplement an AWS CloudTrail trail as an organizational trail. Configure the trail with Amazon CloudWatch Logs forwarding. In CloudWatch Logs, set a metric filter for any user action events that the company specifies. Create an Amazon CloudWatch alarm to provide alerts for occurrences within a reported period and to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic. (correct answer)
  • BImplement an AWS CloudTrail trail. Configure the trail with Amazon CloudWatch Logs forwarding. In CloudWatch Logs, set a metric filter for any user action events that the company specifies. Create an Amazon CloudWatch alarm to provide alerts for occurrences within a reported period and to send messages to an Amazon Simple Queue Service (Amazon SQS) queue.
  • CImplement an AWS CloudTrail trail as an organizational trail. Configure the trail to store logs in an Amazon S3 bucket. Configure an Amazon EC2 instance to mount the S3 bucket as a file system to ingest new log files that are pushed to the S3 bucket. Configure the EC2 instance also to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic when one of the specified actions is found in the logs.
  • DImplement an AWS CloudTrail trail. Configure the trail to store logs in an Amazon S3 bucket. Each hour, create an AWS Glue Data Catalog that references the S3 bucket. Configure Amazon Athena to initiate queries against the Data Catalog to identify the specified actions in the logs.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Implement an AWS CloudTrail trail as an organizational trail. Configure the trail with Amazon CloudWatch Logs forwarding. In CloudWatch Logs, set a metric filter for any user action events that the company specifies....

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS CloudTrail records API activity for auditing and governance. This option meets the real-time / low-latency performance requirement.

SCS-C02 Question 131

Single page →
Topic 1 · Question 131

A company wants to create a log analytics solution for logs generated from its on-premises devices. The logs are collected from the devices onto a server on premises. The company wants to use AWS services to perform near real-time log analysis. The company also wants to store these logs for 365 days for pattern matching and substring search capabilities later. Which solution will meet these requirements with the LEAST development overhead?

  • AInstall Amazon Kinesis Agent on the on-premises server to send the logs to Amazon DynamoDB. Configure an AWS Lambda trigger on DynamoDB streams to perform near real-time log analysis. Export the DynamoDB data to Amazon S3 periodically. Run Amazon Athena queries for pattern matching and substring search. Set up S3 Lifecycle policies to delete the log data after 365 days.
  • BInstall Amazon Managed Streaming for Apache Kafka (Amazon MSK) on the on-premises server. Create an MSK cluster to collect the streaming data and analyze the data in real time. Set the data retention period to 365 days to store the logs persistently for pattern matching and substring search.
  • CInstall Amazon Kinesis Agent on the on-premises server to send the logs to Amazon Kinesis Data Firehose. Configure Amazon Managed Service for Apache Flink (previously known as Amazon Kinesis Data Analytics) as the destination for real-time processing. Store the logs in Amazon OpenSearch Service for pattern matching and substring search. Configure an OpenSearch Service Index State Management (ISM) policy to delete the data after 365 days. (correct answer)
  • DUse Amazon API Gateway and AWS Lambda to write the logs from the on-premises server to Amazon DynamoDB. Configure a Lambda trigger on DynamoDB streams to perform near real-time log analysis. Run Amazon Athena federated queries on DynamoDB data for pattern matching and substring search. Set up TTL to delete data after 365 days.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Install Amazon Kinesis Agent on the on-premises server to send the logs to Amazon Kinesis Data Firehose. Configure Amazon Managed Service for Apache Flink (previously known as Amazon Kinesis Data Analytics) as the des...

Explanation

Kinesis Data Firehose delivers streaming data to destinations like S3/Redshift with no servers to manage. Amazon Kinesis ingests and processes real-time streaming data at scale. Amazon OpenSearch Service provides managed search and log analytics. This option meets the real-time / low-latency performance requirement.

SCS-C02 Question 132

Single page →
Topic 1 · Question 132

A company has a large fleet of Linux Amazon EC2 instances and Windows EC2 instances that run in private subnets. The company wants all remote administration to be performed as securely as possible in the AWS Cloud. Which solution will meet these requirements?

  • ADo not use SSH-RSA private keys during the launch of new instances Implement AWS Systems Manager Session Manager (correct answer)
  • BGenerate new SSH-RSA private keys for existing instances Implement AWS Systems Manager Session Manager
  • CDo not use SSH-RSA private keys during the launch of new instances Configure EC2 Instance Connect
  • DGenerate new SSH-RSA private keys for existing instances Configure EC2 Instance Connect
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Do not use SSH-RSA private keys during the launch of new instances Implement AWS Systems Manager Session Manager

Explanation

AWS Systems Manager operates and automates management of fleets of resources.

SCS-C02 Question 133

Single page →
Topic 1 · Question 133 · Select all that apply

A company has decided to move its fleet of Linux-based web server instances to an Amazon EC2 Auto Scaling group. Currently, the instances are static and are launched manually. When an administrator needs to view log files, the administrator uses SSH to establish a connection to the instances and retrieves the logs manually. The company often needs to query the logs to produce results about application sessions and user issues. The company does not want its new automatically scaling architecture to result in the loss of any log files when instances are scaled in. Which combination of steps should a security engineer take to meet these requirements MOST cost-effectively? (Choose two.)

  • AConfigure a cron job on the instances to forward the log files to Amazon S3 periodically.
  • BConfigure AWS Glue and Amazon Athena to query the log files.
  • CConfigure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs. (correct answer)
  • DConfigure Amazon CloudWatch Logs Insights to query the log files. (correct answer)
  • EConfigure the instances to write the logs to an Amazon Elastic File System (Amazon EFS) volume.
Reveal answer & explanation
Correct answer: C, D

The correct answer is C, D. Option C: Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs. Option D: Configure Amazon CloudWatch Logs Insights to query the log files.

Explanation

Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

SCS-C02 Question 134

Single page →
Topic 1 · Question 134

A company uses an external identity provider to allow federation into different AWS accounts. A security engineer for the company needs to identify the federated user that terminated a production Amazon EC2 instance a week ago. What is the FASTEST way for the security engineer to identify the federated user?

  • AReview the AWS CloudTrail event history logs in an Amazon S3 bucket and look for the TerminateInstances event to identify the federated user from the role session name.
  • BFilter the AWS CloudTrail event history for the TerminateInstances event and identify the assumed IAM role. Review the AssumeRoleWithSAML event call in CloudTrail to identify the corresponding username. (correct answer)
  • CSearch the AWS CloudTrail logs for the TerminateInstances event and note the event time. Review the IAM Access Advisor tab for all federated roles. The last accessed time should match the time when the instance was terminated.
  • DUse Amazon Athena to run a SQL query on the AWS CloudTrail logs stored in an Amazon S3 bucket and filter on the TerminateInstances event. Identify the corresponding role and run another query to filter the AssumeRoleWithWebIdentity event for the user name.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Filter the AWS CloudTrail event history for the TerminateInstances event and identify the assumed IAM role. Review the AssumeRoleWithSAML event call in CloudTrail to identify the corresponding username.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS CloudTrail records API activity for auditing and governance.

SCS-C02 Question 135

Single page →
Topic 1 · Question 135

Two Amazon EC2 instances in different subnets should be able to connect to each other but cannot. It has been confirmed that other hosts in the same subnets are able to communicate successfully, and that security groups have valid ALLOW rules in place to permit this traffic. Which of the following troubleshooting steps should be performed?

  • ACheck inbound and outbound security groups, looking for DENY rules
  • BCheck inbound and outbound Network ACL rules, looking for DENY rules (correct answer)
  • CReview the rejected packet reason codes in the VPC Flow Logs
  • DUse AWS X-Ray to trace the end-to-end application flow
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Check inbound and outbound Network ACL rules, looking for DENY rules.

SCS-C02 Question 136

Single page →
Topic 1 · Question 136 · Select all that apply

A company has an application that needs to get objects from an Amazon S3 bucket. The application runs on Amazon EC2 instances. All the objects in the S3 bucket are encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The resources in the VPC do not have access to the internet and use a gateway VPC endpoint to access Amazon S3. The company discovers that the application is unable to get objects from the S3 bucket. Which factors could cause this issue? (Choose three.)

  • AThe IAM instance profile that is attached to the EC2 instances does not allow the s3:ListBucket action for the S3 bucket. (correct answer)
  • BThe IAM instance profile that is attached to the EC2 instances does not allow the s3:ListParts action for the S3 bucket.
  • CThe KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:ListKeys action to the EC2 instance profile ARN.
  • DThe KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:Decrypt action to the EC2 instance profile ARN. (correct answer)
  • EThe S3 bucket policy does not allow access from the gateway VPC endpoint. (correct answer)
  • FThe security group that is attached to the EC2 instances is missing an inbound rule from the S3 managed prefix list over port 443.
Reveal answer & explanation
Correct answer: A, D, E

The correct answer is A, D, E. Option A: The IAM instance profile that is attached to the EC2 instances does not allow the s3:ListBucket action for the S3 bucket. Option D: The KMS key policy that encrypts the objects in the S3 bucket does not allow the kms:Decrypt action to the EC2 instance profile ARN. Option E: The S3 bucket policy does not allow access from the gateway VPC endpoint.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon S3 provides durable, scalable object storage that is fully managed. A gateway VPC endpoint gives private, no-cost access to Amazon S3 and DynamoDB from within the VPC.

SCS-C02 Question 137

Single page →
Topic 1 · Question 137

A company runs workloads in the us-east-1 Region. The company has never deployed resources to other AWS Regions and does not have any multi-Region resources. The company needs to replicate its workloads and infrastructure to the us-west-1 Region. A security engineer must implement a solution that uses AWS Secrets Manager to store secrets in both Regions. The solution must use AWS Key Management Service (AWS KMS) to encrypt the secrets. The solution must minimize latency and must be able to work if only one Region is available. The security engineer uses Secrets Manager to create the secrets in us-east-1. What should the security engineer do next to meet the requirements?

  • AEncrypt the secrets in us-east-1 by using an AWS managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using a new AWS managed KMS key in us-west-1.
  • BEncrypt the secrets in us-east-1 by using an AWS managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1.
  • CEncrypt the secrets in us-east-1 by using a customer managed KMS key. Configure resources in us-west-1 to call the Secrets Manager endpoint in us-east-1.
  • DEncrypt the secrets in us-east-1 by using a customer managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using the customer managed KMS key from us-east-1. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Encrypt the secrets in us-east-1 by using a customer managed KMS key. Replicate the secrets to us-west-1. Encrypt the secrets in us-west-1 by using the customer managed KMS key from us-east-1.

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SCS-C02 Question 138

Single page →
Topic 1 · Question 138

A company is using an AWS Key Management Service (AWS KMS) AWS owned key in its application to encrypt files in an AWS account. The company's security team wants the ability to change to new key material for new files whenever a potential key breach occurs. A security engineer must implement a solution that gives the security team the ability to change the key whenever the team wants to do so. Which solution will meet these requirements?

  • ACreate a new customer managed key. Add a key rotation schedule to the key. Invoke the key rotation schedule every time the security team requests a key change.
  • BCreate a new AWS managed key. Add a key rotation schedule to the key. Invoke the key rotation schedule every time the security team requests a key change.
  • CCreate a key alias. Create a new customer managed key every time the security team requests a key change. Associate the alias with the new key. (correct answer)
  • DCreate a key alias. Create a new AWS managed key every time the security team requests a key change. Associate the alias with the new key.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a key alias. Create a new customer managed key every time the security team requests a key change. Associate the alias with the new key.

SCS-C02 Question 139

Single page →
Topic 1 · Question 139

A security engineer needs to set up an Amazon CloudFront distribution for an Amazon S3 bucket that hosts a static website. The security engineer must allow only specified IP addresses to access the website. The security engineer also must prevent users from accessing the website directly by using S3 URLs. Which solution will meet these requirements?

  • AGenerate an S3 bucket policy. Specify cloudfront.amazonaws.com as the principal. Use the aws:SourceIp condition key to allow access only if the request comes from the specified IP addresses.
  • BCreate a CloudFront origin access control (OAC). Create the S3 bucket policy so that only the OAC has access. Create an AWS WAF web ACL, and add an IP set rule. Associate the web ACL with the CloudFront distribution. (correct answer)
  • CImplement security groups to allow only the specified IP addresses access and to restrict S3 bucket access by using the CloudFront distribution.
  • DCreate an S3 bucket access point to allow access from only the CloudFront distribution. Create an AWS WAF web ACL and add an IP set rule. Associate the web ACL with the CloudFront distribution.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a CloudFront origin access control (OAC). Create the S3 bucket policy so that only the OAC has access. Create an AWS WAF web ACL, and add an IP set rule. Associate the web ACL with the CloudFront distribution.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS WAF protects web applications from common exploits and malicious requests.

SCS-C02 Question 140

Single page →
Topic 1 · Question 140

A company uses user data scripts that contain sensitive information to bootstrap Amazon EC2 instances. A security engineer discovers that this sensitive information is viewable by people who should not have access to it. What is the MOST secure way to protect the sensitive information used to bootstrap the instances?

  • AStore the scripts in the AMI and encrypt the sensitive data using AWS KMS. Use the instance role profile to control access to the KMS keys needed to decrypt the data.
  • BStore the sensitive data in AWS Systems Manager Parameter Store using the encrypted string parameter and assign the GetParameters permission to the EC2 instance role. (correct answer)
  • CExternalize the bootstrap scripts in Amazon S3 and encrypt them using AWS KMS. Remove the scripts from the instance and clear the logs after the instance is configured.
  • DBlock user access of the EC2 instance's metadata service using IAM policies. Remove all scripts and clear the logs after the scripts have completed.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Store the sensitive data in AWS Systems Manager Parameter Store using the encrypted string parameter and assign the GetParameters permission to the EC2 instance role.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Systems Manager Parameter Store securely stores configuration data and secrets. AWS Systems Manager operates and automates management of fleets of resources.

Showing questions 121–140 of 307 · Page 7 of 16