🔍

SCS-C02 — questions

Page 8 of 16 · 307 total questions.

SCS-C02 Question 141

Single page →
Topic 1 · Question 141

A company has a VPC that has no internet access and has the private DNS hostnames option enabled. An Amazon Aurora database is running inside the VPC. A security engineer wants to use AWS Secrets Manager to automatically rotate the credentials for the Aurora database. The security engineer configures the Secrets Manager default AWS Lambda rotation function to run inside the same VPC that the Aurora database uses. However, the security engineer determines that the password cannot be rotated properly because the Lambda function cannot communicate with the Secrets Manager endpoint. What is the MOST secure way that the security engineer can give the Lambda function the ability to communicate with the Secrets Manager endpoint?

  • AAdd a NAT gateway to the VPC to allow access to the Secrets Manager endpoint.
  • BAdd a gateway VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.
  • CAdd an interface VPC endpoint to the VPC to allow access to the Secrets Manager endpoint. (correct answer)
  • DAdd an internet gateway for the VPC to allow access to the Secrets Manager endpoint.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Add an interface VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.

Explanation

A VPC endpoint provides private connectivity to AWS services without traversing the public internet. AWS Secrets Manager stores and automatically rotates secrets such as database credentials.

SCS-C02 Question 142

Single page →
Topic 1 · Question 142

A company has two AWS accounts: Account A and Account B. Each account has a VPC. An application that runs in the VPC in Account A needs to write to an Amazon S3 bucket in Account B. The application in Account A already has permission to write to the S3 bucket in Account B. The application and the S3 bucket are in the same AWS Region. The company cannot send network traffic over the public internet. Which solution will meet these requirements?

  • AIn both accounts, create a transit gateway and VPC attachments in a subnet in each Availability Zone. Update the VPC route tables.
  • BDeploy a software VPN appliance in Account A. Create a VPN connection between the software VPN appliance and a virtual private gateway in Account B.
  • CCreate a VPC peering connection between the VPC in Account A and the VPC in Account B. Update the VPC route tables, network ACLs, and security groups to allow network traffic between the peered IP ranges
  • DIn Account A, create a gateway VPC endpoint for Amazon S3. Update the VPC route table in Account A. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: In Account A, create a gateway VPC endpoint for Amazon S3. Update the VPC route table in Account A.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. A gateway VPC endpoint gives private, no-cost access to Amazon S3 and DynamoDB from within the VPC. A VPC endpoint provides private connectivity to AWS services without traversing the public internet.

SCS-C02 Question 143

Single page →
Topic 1 · Question 143

A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2 instance that uses Amazon Elastic Block Store (Amazon EBS)-based storage. The instance is making connections to known malicious addresses. The instance is in a development account within a VPC that is in the us-east-1 Region. The VPC contains an internet gateway and has a subnet in us-east-1a and us-east-1b. Each subnet is associate with a route table that uses the internet gateway as a default route. Each subnet also uses the default network ACL. The suspicious EC2 instance runs within the us-east-1b subnet. During an initial investigation, a security engineer discovers that the suspicious instance is the only instance that runs in the subnet. Which response will immediately mitigate the attack and help investigate the root cause?

  • ALog in to the suspicious instance and use the netstat command to identify remote connections. Use the IP addresses from these remote connections to create deny rules in the security group of the instance. Install diagnostic tools on the instance for investigation. Update the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections as the first rule during the investigation of the instance.
  • BUpdate the outbound network ACL for the subnet in us-east-1 b to explicitly deny all connections as the first rule. Replace the security group with a new security group that allows connections only from a diagnostics security group. Update the outbound network ACL for the us-east-1 b subnet to remove the deny all rule. Launch a new EC2 instance that has diagnostic tools. Assign the new security group to the new EC2 instance. Use the new EC2 instance to investigate the suspicious instance. (correct answer)
  • CEnsure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the suspicious EC2 instance will not delete upon termination. Terminate the instance. Launch a new EC2 instance in us-east-1a that has diagnostic tools. Mount the EBS volumes from the terminated instance for investigation.
  • DCreate an AWS WAF web ACL that denies traffic to and from the suspicious instance. Attach the AWS WAF web ACL to the instance to mitigate the attack. Log in to the instance and install diagnostic tools to investigate the instance.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Update the outbound network ACL for the subnet in us-east-1 b to explicitly deny all connections as the first rule. Replace the security group with a new security group that allows connections only from a diagnostics...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SCS-C02 Question 144

Single page →
Topic 1 · Question 144 · Select all that apply

An online media company has an application that customers use to watch events around the world. The application is hosted on a fleet of Amazon EC2 instances that run Amazon Linux 2. The company uses AWS Systems Manager to manage the EC2 instances. The company applies patches and application updates by using the AWS-AmazonLinux2DefaultPatchBaseline patching baseline in Systems Manager Patch Manager. The company is concerned about potential attacks on the application during the week of an upcoming event. The company needs a solution that can immediately deploy patches to all the EC2 instances in response to a security incident or vulnerability. The solution also must provide centralized evidence that the patches were applied successfully. Which combination of steps will meet these requirements? (Choose two.)

  • ACreate a new patching baseline in Patch Manager. Specify Amazon Linux 2 as the product. Specify Security as the classification. Set the automatic approval for patches to 0 days. Ensure that the new patching baseline is the designated default for Amazon Linux 2. (correct answer)
  • BUse the Patch Now option with the scan and install operation in the Patch Manager console to apply patches against the baseline to all nodes. Specify an Amazon S3 bucket as the patching log storage option. (correct answer)
  • CUse the Clone function of Patch Manager to create a copy of the AWS-AmazonLmux2DefaultPatchBaseline built-in baseline. Set the automatic approval for patches to 1 day.
  • DCreate a patch policy that patches all managed nodes and sends a patch operation log output to an Amazon S3 bucket. Use a custom scan schedule to set Patch Manager to check every hour for new patches. Assign the baseline to the patch policy.
  • EUse Systems Manager Application Manager to inspect the package versions that were installed on the EC2 instances. Additionally use Application Manager to validate that the patches were correctly installed.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Create a new patching baseline in Patch Manager. Specify Amazon Linux 2 as the product. Specify Security as the classification. Set the automatic approval for patches to 0 days. Ensure that the new patching baseline i... Option B: Use the Patch Now option with the scan and install operation in the Patch Manager console to apply patches against the baseline to all nodes. Specify an Amazon S3 bucket as the patching log storage option.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SCS-C02 Question 145

Single page →
Topic 1 · Question 145

A developer operations team uses AWS Identity and Access Management (IAM) to manage user permissions. The team created an Amazon EC2 instance profile role that uses an AWS managed ReadOnlyAccess policy. When an application that is running on Amazon EC2 tries to read a file from an encrypted Amazon S3 bucket, the application receives an AccessDenied error. The team administrator has verified that the S3 bucket policy allows everyone in the account to access the S3 bucket. There is no object ACL that is attached to the file. What should the administrator do to fix the IAM access issue?

  • AEdit the ReadOnlyAccess policy to add kms:Decrypt actions
  • BAdd the EC2 IAM role as the authorized Principal to the S3 bucket policy
  • CAttach an inline policy with kms:Decrypt permissions to the IAM role (correct answer)
  • DAttach an inline policy with S3:* permissions to the IAM role
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Attach an inline policy with kms:Decrypt permissions to the IAM role

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SCS-C02 Question 146

Single page →
Topic 1 · Question 146

A company uses AWS Organizations and has Amazon Elastic Kubernetes Service (Amazon EKS) clusters in many AWS accounts. A security engineer integrates Amazon EKS with AWS CloudTrail. The CloudTrail trails are stored in an Amazon S3 bucket in each account to monitor API calls. The security engineer observes that CloudTrail logs are not displaying Kubernetes pod creation events. What should the security engineer do to view the Kubernetes events from Amazon CloudWatch?

  • AConfigure the EKS clusters to use private S3 VPC endpoints. Configure the S3 buckets for logging.
  • BEnable Kubernetes API server component logs for each cluster. (correct answer)
  • CEnable cross-origin resource sharing (CORS) in the S3 bucket that is used for logging.
  • DConfigure CloudWatch. View the events in the CloudWatch console.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable Kubernetes API server component logs for each cluster.

SCS-C02 Question 147

Single page →
Topic 1 · Question 147

A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off. What is the MOST efficient way to implement this solution?

  • AUse AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation. (correct answer)
  • BCreate an Amazon EventBridge event with a cloudtrail.amazonaws.com event source and a StartLogging event name to invoke an AWS Lambda function to call the StartLogging API.
  • CCreate an Amazon CloudWatch alarm with a cloudtrail.amazonaws.com event source and a StopLoggmg event name to invoke an AWS Lambda function to call the StartLogging API.
  • DMonitor AWS Trusted Advisor to ensure CloudTrail logging is enabled.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation.

Explanation

AWS CloudTrail records API activity for auditing and governance. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 148

Single page →
Topic 1 · Question 148

An ecommerce company is developing new architecture for an application release. The company needs to implement TLS for incoming traffic to the application. Traffic for the application will originate from the internet. TLS does not have to be implemented in an end-to-end configuration because the company is concerned about impacts on performance The incoming traffic types will be HTTP and HTTPS The application uses ports 80 and 443. What should a security engineer do to meet these requirements?

  • ACreate a public Application Load Balancer. Create two listeners: one listener on port 80 and one listener on port 443. Create one target group. Create a rule to forward traffic from port 80 to the listener on port 443. Provision a public TLS certificate in AWS Certificate Manager (ACM). Attach the certificate to the listener on port 443. (correct answer)
  • BCreate a public Application Load Balancer. Create two listeners one listener on port 80 and one listener on port 443. Create one target group. Create a rule to forward traffic from port 80 to the listener on port 443. Provision a public TLS certificate in AWS Certificate Manager (ACM). Attach the certificate to the listener on port 80.
  • CCreate a public Network Load Balancer. Create two listeners one listener on port 80 and one listener on port 443. Create one target group. Create a rule to forward traffic from port 80 to the listener on port 443. Set the protocol for the listener on port 443 to TLS.
  • DCreate a public Network Load Balancer. Create a listener on port 443. Create one target group. Create a rule to forward traffic from port 443 to the target group. Set the protocol for the listener on port 443 to TLS.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a public Application Load Balancer. Create two listeners: one listener on port 80 and one listener on port 443. Create one target group. Create a rule to forward traffic from port 80 to the listener on port 443...

Explanation

An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale. AWS Certificate Manager provisions and renews TLS certificates automatically.

SCS-C02 Question 149

Single page →
Topic 1 · Question 149

A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets. The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region. Which solution will meet these requirements?

  • AConfigure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.
  • BImplement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. (correct answer)
  • CConfigure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucket in the secondary Region.
  • DConfigure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Configure S3 object versioning on the S3 bucket in the secondary Region.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SCS-C02 Question 150

Single page →
Topic 1 · Question 150 · Select all that apply

A company in France uses Amazon Cognito with the Cognito Hosted UI as an identity broker for sign-in and sign-up processes. The company is marketing an application and expects that all the application’s users will come from France. When the company launches the application, the company’s security team observes fraudulent sign-ups for the application. Most of the fraudulent registrations are from users outside of France. The security team needs a solution to perform custom validation at sign-up. Based on the results of the validation, the solution must accept or deny the registration request. Which combination of steps will meet these requirements? (Choose two.)

  • ACreate a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool. (correct answer)
  • BUse a geographic match rule statement to configure an AWS WAF web ACL Associate the web ACL with the Amazon Cognito user pool. (correct answer)
  • CConfigure an app client for the application's Amazon Cognito user pool. Use the app client ID to validate the requests in the hosted UI.
  • DUpdate the application’s Amazon Cognito user pool to configure a geographic restriction setting.
  • EUse Amazon Cognito to configure a social identity provider (IdP) to validate the requests on the hosted UI.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Create a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool. Option B: Use a geographic match rule statement to configure an AWS WAF web ACL Associate the web ACL with the Amazon Cognito user pool.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon Cognito manages user sign-up, sign-in and federated identity for applications. AWS WAF protects web applications from common exploits and malicious requests.

SCS-C02 Question 151

Single page →
Topic 1 · Question 151 · Select all that apply

A security engineer is configuring AWS Config for an AWS account that uses a new IAM entity. When the security engineer tries to configure AWS Config rules and automatic remediation options, errors occur. In the AWS CloudTrail logs, the security engineer sees the following error message: “Insufficient delivery policy to s3 bucket: DOC-EXAMPLE-BUCKET, unable to write to bucket, provided s3 key prefix is ‘null’.” Which combination of steps should the security engineer take to remediate this issue? (Choose two.)

  • ACheck the Amazon S3 bucket policy. Verify that the policy allows the config amazonaws,com service to write to the target bucket. (correct answer)
  • BVerify that the IAM entity has the permissions necessary to perform the s3:GetBucketAcl and s3:PutObject* operations to write to the target bucket. (correct answer)
  • CVerify that the Amazon S3 bucket policy has the permissions necessary to perform the s3:GetBucketAcl and s3:PutObject* operations to write to the target bucket.
  • DCheck the policy that is associated with the IAM entity. Verify that the policy allows the config.amazonaws.com service to write to the target bucket.
  • EVerify that the AWS Config service role has permissions to invoke the BatchGetResourceConfig action instead of the GetResourceConfigHistory action and s3:PutObject* operation.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Check the Amazon S3 bucket policy. Verify that the policy allows the config amazonaws,com service to write to the target bucket. Option B: Verify that the IAM entity has the permissions necessary to perform the s3:GetBucketAcl and s3:PutObject* operations to write to the target bucket.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 152

Single page →
Topic 1 · Question 152 · Select all that apply

A company is undergoing a layer 3 and layer 4 DDoS attack on its web servers running on AWS. Which combination of AWS services and features will provide protection in this scenario? (Choose three.)

  • AAmazon Route 53 (correct answer)
  • BAWS Certificate Manager (ACM)
  • CAmazon S3
  • DAWS Shield (correct answer)
  • ENetwork Load Balancer (correct answer)
  • FAmazon GuardDuty
Reveal answer & explanation
Correct answer: A, D, E

The correct answer is A, D, E. Option A: Amazon Route 53 Option D: AWS Shield Option E: Network Load Balancer

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. A Network Load Balancer handles very high throughput TCP/UDP traffic with ultra-low latency and static IPs. A load balancer distributes traffic across targets in multiple AZs for availability and scale.

SCS-C02 Question 153

Single page →
Topic 1 · Question 153

A company wants to implement host-based security for Amazon EC2 instances and containers in Amazon Elastic Container Registry (Amazon ECR). The company has deployed AWS Systems Manager Agent (SSM Agent) on the EC2 instances. All the company's AWS accounts are in one organization in AWS Organizations. The company will analyze the workloads for software vulnerabilities and unintended network exposure. The company will push any findings to AWS Security Hub, which the company has configured for the organization. The company must deploy the solution to all member accounts, including new accounts, automatically. When new workloads come online, the solution must scan the workloads. Which solution will meet these requirements?

  • AUse SCPs to configure scanning of EC2 instances and ECR containers for all accounts in the organization.
  • BConfigure a delegated administrator for Amazon GuardDuty for the organization. Create an Amazon EventBridge rule to initiate analysis of ECR containers
  • CConfigure a delegated administrator for Amazon Inspector for the organization. Configure automatic scanning for new member accounts. (correct answer)
  • DConfigure a delegated administrator for Amazon Inspector for the organization. Create an AWS Config rule to initiate analysis of ECR containers.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure a delegated administrator for Amazon Inspector for the organization. Configure automatic scanning for new member accounts.

Explanation

Amazon Inspector automatically scans workloads for software vulnerabilities. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 154

Single page →
Topic 1 · Question 154

A company uses AWS Organizations to manage several AWS accounts. The company processes a large volume of sensitive data. The company uses a serverless approach to microservices. The company stores all the data in either Amazon S3 or Amazon DynamoDB. The company reads the data by using either AWS Lambda functions or container-based services that the company hosts on Amazon Elastic Kubernetes Service (Amazon EKS) on AWS Fargate. The company must implement a solution to encrypt all the data at rest and enforce least privilege data access controls. The company creates an AWS Key Management Service (AWS KMS) customer managed key. What should the company do next to meet these requirements?

  • ACreate a key policy that allows the kms:Decrypt action only for Amazon S3 and DynamoDB. Create an SCP that denies the creation of S3 buckets and DynamoDB tables that are not encrypted with the key.
  • BCreate an IAM policy that denies the kms:Decrypt action for the key. Create a Lambda function than runs on a schedule to attach the policy to any new roles. Create an AWS Config rule to send alerts for resources that are not encrypted with the key.
  • CCreate a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB, Lambda, and Amazon EKS. Create an SCP that denies the creation of S3 buckets and DynamoDB tables that are not encrypted with the key. (correct answer)
  • DCreate a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB, Lambda, and Amazon EKS. Create an AWS Config rule to send alerts for resources that are not encrypted with the key.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a key policy that allows the kms:Decrypt action only for Amazon S3, DynamoDB, Lambda, and Amazon EKS. Create an SCP that denies the creation of S3 buckets and DynamoDB tables that are not encrypted with the key.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EKS runs managed Kubernetes when you need the Kubernetes ecosystem. Amazon S3 provides durable, scalable object storage that is fully managed.

SCS-C02 Question 155

Single page →
Topic 1 · Question 155

An AWS Lambda function was misused to alter data, and a security engineer must identify who invoked the function and what output was produced. The engineer cannot find any logs created by the Lambda function in Amazon CloudWatch Logs. Which of the following explains why the logs are not available?

  • AThe execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs. (correct answer)
  • BThe Lambda function was invoked by using Amazon API Gateway, so the logs are not stored in CloudWatch Logs.
  • CThe execution role for the Lambda function did not grant permissions to write to the Amazon S3 bucket where CloudWatch Logs stores the logs.
  • DThe version of the Lambda function that was invoked was not current.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SCS-C02 Question 156

Single page →
Topic 1 · Question 156

A company is worried about potential DDoS attacks. The company has a web application that runs on Amazon EC2 instances. The application uses Amazon S3 to serve static content such as images and videos. A security engineer must create a resilient architecture that can withstand DDoS attacks. Which solution will meet these requirements MOST cost-effectively?

  • ACreate an Amazon CloudWatch alarm that invokes an AWS Lambda function when an EC2 instance’s CPU utilization reaches 90%. Program the Lambda function to update security groups that are attached to the EC2 instance to deny inbound ports 80 and 443.
  • BPut the EC2 instances into an Auto Scaling group behind an Elastic Load Balancing (ELB) load balancer. Use Amazon CioudFront with Amazon S3 as an origin. (correct answer)
  • CSet up a warm standby disaster recovery (DR) environment. Fail over to the warm standby DR environment if a DDoS attack is detected on the application.
  • DSubscribe to AWS Shield Advanced. Configure permissions to allow the Shield Response Team to manage resources on the company's behalf during a DDoS event.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Put the EC2 instances into an Auto Scaling group behind an Elastic Load Balancing (ELB) load balancer. Use Amazon CioudFront with Amazon S3 as an origin.

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon S3 provides durable, scalable object storage that is fully managed. This option delivers the requirement at the lowest cost.

SCS-C02 Question 157

Single page →
Topic 1 · Question 157

A company uses an organization in AWS Organizations to manage hundreds of AWS accounts. Some of the accounts provide access to external AWS principals through cross-account IAM roles and Amazon S3 bucket policies. The company needs to identify which external principals have access to which accounts. Which solution will provide this information?

  • AEnable AWS Identity and Access Management Access Analyzer for the organization. Configure the organization as a zone of trust. Filter findings by AWS account ID. (correct answer)
  • BCreate a custom AWS Config rule to monitor IAM roles in each account. Deploy an AWS Config aggregator to a central account. Filter findings by AWS account ID.
  • CActivate Amazon Inspector. Integrate Amazon Inspector with AWS Security Hub. Filter findings by AWS account ID for the IAM role resource type and the S3 bucket policy resource type.
  • DConfigure the organization to use Amazon GuardDuty. Filter findings by AWS account ID for the Discovery:IAMUser/AnomalousBehavior finding type.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable AWS Identity and Access Management Access Analyzer for the organization. Configure the organization as a zone of trust. Filter findings by AWS account ID.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 158

Single page →
Topic 1 · Question 158

A company has AWS accounts in an organization in AWS Organizations. The company needs to install a corporate software package on all Amazon EC2 instances for all the accounts in the organization. A central account provides base AMIs for the EC2 instances. The company uses AWS Systems Manager for software inventory and patching operations. A security engineer must implement a solution that detects EC2 instances that do not have the required software. The solution also must automatically install the software if the software is not present. Which solution will meet these requirements?

  • AProvide new AMIs that have the required software pre-installed. Apply a tag to the AMIs to indicate that the AMIs have the required software. Configure an SCP that allows new EC2 instances to be launched only if the instances have the tagged AMIs. Tag all existing EC2 instances.
  • BConfigure a custom patch baseline in Systems Manager Patch Manager. Add the package name for the required software to the approved packages list. Associate the new patch baseline with all EC2 instances. Set up a maintenance window for software deployment.
  • CCentrally enable AWS Config. Set up the ec2-managedinstance-applications-required AWS Config rule for all accounts. Create an Amazon EventBridge rule that reacts to AWS Config events. Configure the EventBridge rule to invoke an AWS Lambda function that uses Systems Manager Run Command to install the required software. (correct answer)
  • DCreate a new Systems Manager Distributor package for the required software. Specify the download location. Select all EC2 instances in the different accounts. Install the software by using Systems Manager Run Command.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Centrally enable AWS Config. Set up the ec2-managedinstance-applications-required AWS Config rule for all accounts. Create an Amazon EventBridge rule that reacts to AWS Config events. Configure the EventBridge rule to...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

SCS-C02 Question 159

Single page →
Topic 1 · Question 159 · Select all that apply

A development team is creating an open source toolset to manage a company's software as a service (SaaS) application. The company stores the code in a public repository so that anyone can view and download the toolset's code. The company discovers that the code contains an IAM access key and secret key that provide access to internal resources in the company’s AWS environment A security engineer must implement a solution to identify whether unauthorized usage of the exposed credentials has occurred. The solution also must prevent any additional usage of the exposed credentials. Which combination of steps will meet these requirements? (Choose two.)

  • AUse AWS Identity and Access Management Access Analyzer to determine which resources the exposed credentials accessed and who used them. (correct answer)
  • BDeactivate the exposed IAM access key from the user’s IAM account. (correct answer)
  • CCreate a rule in Amazon GuardDuty to block the access key in the source code from being used.
  • DCreate a new IAM access key and secret key for the user whose credentials were exposed.
  • EGenerate an IAM credential report. Check the report to determine when the user that owns the access key last logged in.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Use AWS Identity and Access Management Access Analyzer to determine which resources the exposed credentials accessed and who used them. Option B: Deactivate the exposed IAM access key from the user’s IAM account.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SCS-C02 Question 160

Single page →
Topic 1 · Question 160

A company needs to create a centralized solution to analyze log files. The company uses an organization in AWS Organizations to manage its AWS accounts. The solution must aggregate and normalize events from the following sources: • The entire organization in Organizations • All AWS Marketplace offerings that run in the company’s AWS accounts • The company's on-premises systems Which solution will meet these requirements?

  • AConfigure a centralized Amazon S3 bucket for the logs. Enable VPC Flow Logs, AWS CloudTrail. and Amazon Route 53 logs in all accounts. Configure all accounts to use the centralized S3 bucket. Configure AWS Glue crawlers to parse the log files. Use Amazon Athena to query the log data.
  • BConfigure log streams in Amazon CloudWatch Logs for the sources that need monitoring Create log subscription filters for each log stream. Forward the messages to Amazon OpenSearch Service for analysis.
  • CSet up a delegated Amazon Security Lake administrator account in Organizations. Enable and configure Security Lake for the organization. Add the accounts that need monitoring. Use Amazon Athena to query the log data. (correct answer)
  • DApply an SCP to configure all member accounts and services to deliver log files to a centralized Amazon S3 bucket. Use Amazon OpenSearch Service to query the centralized S3 bucket for log entries.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Set up a delegated Amazon Security Lake administrator account in Organizations. Enable and configure Security Lake for the organization. Add the accounts that need monitoring. Use Amazon Athena to query the log data.

Explanation

Amazon Athena runs serverless SQL queries directly on data in Amazon S3 with no infrastructure to manage. AWS Organizations centrally governs and secures multiple AWS accounts. AWS Config tracks resource configuration changes and evaluates compliance.

Showing questions 141–160 of 307 · Page 8 of 16