SCS-C02 — questions

Page 9 of 16 · 307 total questions.

SCS-C02 Question 161

Single page →

Topic 1 · Question 161

A company uses AWS Organizations. The company has more than 100 AWS accounts and will increase the number of accounts. The company also uses an external corporate identity provider (IdP). The company needs to provide users with role-based access to the accounts. The solution must maximize scalability and operational efficiency. Which solution will meet these requirements?

AIn each account, create a set of dedicated IAM users. Ensure that all users assume these IAM users through federation with the existing IdP.
BDeploy an IAM role in a central identity account. Allow users to assume the role through federation with the existing IdP. In each account, deploy a set of IAM roles that match the desired access patterns. Include a trust policy that allows access from the central identity account. Edit the permissions policy for the role in each account to match user access requirements.
CEnable AWS IAM Identity Center. Integrate IAM Identity Center with the company's existing IdP. Create permission sets that match the desired access patterns. Assign permissions to match user access requirements. (correct answer)
DIn each account, deploy a set of IAM roles that match the desired access patterns. Create a trust policy with the existing IdP. Update each role's permissions policy to use SAML-based IAM condition keys that are based on user access requirements.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Enable AWS IAM Identity Center. Integrate IAM Identity Center with the company's existing IdP. Create permission sets that match the desired access patterns. Assign permissions to match user access requirements.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS IAM Identity Center (SSO) centrally manages workforce access to multiple accounts and apps.

SCS-C02 Question 162

Single page →

Topic 1 · Question 162

A company has a web-based application that runs behind an Application Load Balancer (ALB). The application is experiencing a credential stuffing attack that is producing many failed login attempts. The attack is coming from many IP addresses. The login attempts are using a user agent string of a known mobile device emulator. A security engineer needs to implement a solution to mitigate the credential stuffing attack. The solution must still allow legitimate logins to the application. Which solution will meet these requirements?

ACreate an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.
BModify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack.
CCreate an AWS WAF web ACL for the ALB Create a custom rule that blocks requests that contain the user agent string of the device emulator. (correct answer)
DCreate an AWS WAF web ACL for the ALB. Create a custom rule that allows requests from legitimate user agent strings.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create an AWS WAF web ACL for the ALB Create a custom rule that blocks requests that contain the user agent string of the device emulator.

Explanation

AWS WAF protects web applications from common exploits and malicious requests.

SCS-C02 Question 163

Single page →

Topic 1 · Question 163

A company is investigating controls to protect sensitive data. The company uses Amazon Simple Notification Service (Amazon SNS) topics to publish messages from application components to custom logging services. The company is concerned that an application component might publish sensitive data that will be accidentally exposed in transaction logs and debug logs. Which solution will protect the sensitive data in these messages from accidental exposure?

AUse Amazon Made to scan the SNS topics for sensitive data elements in the SNS messages. Create an AWS Lambda function that masks sensitive data inside the messages when Macie records a new finding.
BConfigure an inbound message data protection policy. In the policy, include the De-identify operation to mask the sensitive data inside the messages. Apply the policy to the SNS topics. (correct answer)
CConfigure the SNS topics with an AWS Key Management Service (AWS KMS) customer managed key to encrypt the data elements inside the messages. Grant permissions to all message publisher IAM roles to allow access to the key to encrypt data.
DCreate an Amazon GuardDuty finding for sensitive data that is transmitted to the SNS topics. Create an AWS Security Hub custom remediation action to block messages that contain sensitive data from being delivered to subscribers of the SNS topics.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Configure an inbound message data protection policy. In the policy, include the De-identify operation to mask the sensitive data inside the messages. Apply the policy to the SNS topics.

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 164

Single page →

Topic 1 · Question 164

A company has created a set of AWS Lambda functions to automate incident response steps for incidents that occur on Amazon EC2 instances. The Lambda functions need to collect relevant artifacts, such as instance ID and security group configuration. The Lambda functions must then write a summary to an Amazon S3 bucket. The company runs its workloads in a VPC that uses public subnets and private subnets. The public subnets use an internet gateway to access the internet. The private subnets use a NAT gateway to access the internet. All network traffic to Amazon S3 that is related to the incident response process must use the AWS network. This traffic must not travel across the internet. Which solution will meet these requirements?

ADeploy the Lambda functions to a private subnet in the VPC. Configure the Lambda functions to access the S3 service through the NAT gateway.
BDeploy the Lambda functions to a private subnet in the VPC. Create an S3 gateway endpoint to access the S3 service. (correct answer)
CDeploy the S3 bucket and the Lambda functions in the same private subnet. Configure the Lambda functions to use the default endpoint for the S3 service.
DDeploy an Amazon Simple Queue Service (Amazon SQS) queue and the Lambda functions in the same private subnet. Configure the Lambda functions to send data to the SQS queue. Configure the SQS queue to send data to the S3 bucket.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Deploy the Lambda functions to a private subnet in the VPC. Create an S3 gateway endpoint to access the S3 service.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed.

SCS-C02 Question 165

Single page →

Topic 1 · Question 165

A company uses an organization in AWS Organizations to manage its AWS accounts. The company has implemented an SCP in the root account to prevent resources from being shared with external accounts. The company now needs to allow applications in its marketing team's AWS account to share resources with external accounts. The company must continue to prevent all the other accounts in the organization from sharing resources with external accounts. All the accounts in the organization are members of the same OU. Which solution will meet these requirements?

ACreate a new SCP in the marketing team's account Configure the SCP to explicitly allow resource sharing.
BEdit the existing SCP to add a Condition statement that excludes the marketing team's account. (correct answer)
CEdit the existing SCP to include an Allow statement that specifies the marketing team's account.
DCreate an IAM permissions boundary policy to explicitly allow resource sharing Attach the policy to IAM users in the marketing team's account.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Edit the existing SCP to add a Condition statement that excludes the marketing team's account.

Explanation

Service Control Policies set guardrails on what accounts in an organization can do.

SCS-C02 Question 166

Single page →

Topic 1 · Question 166 · Select all that apply

A security administrator has enabled AWS Security Hub for all the AWS accounts in an organization in AWS Organizations. The security team wants near-real-time response and remediation for deployed AWS resources that do not meet security standards. All changes must be centrally logged for auditing purposes. The organization has reached the quotas for the number of SCPs attached to an OU and SCP document size. The team wants to avoid making any changes to any of the SCPs. The solution must maximize scalability and cost-effectiveness. Which combination of actions should the security administrator take to meet these requirements? (Choose three.)

ACreate an AWS Config custom rule to detect configuration changes to AWS resources. Create an AWS Lambda function to remediate the AWS resources in the delegated administrator AWS account. (correct answer)
BUse AWS Systems Manager Change Manager to track configuration changes to AWS resources. Create a Systems Manager document to remediate the AWS resources in the delegated administrator AWS account.
CCreate a Security Hub custom action to reference in an Amazon EventBridge event rule in the delegated administrator AWS account. (correct answer)
DCreate an Amazon EventBridge event rule to Invoke an AWS Lambda function that will take action on AWS resources. (correct answer)
ECreate an Amazon EventBridge event rule to invoke an AWS Lambda function that will evaluate AWS resource configuration for a set of API requests and create a finding for noncompllant AWS resources.
FCreate an Amazon EventBridge event rule to invoke an AWS Lambda function on a schedule to assess specific AWS Config rules.

Reveal answer & explanation

Correct answer: A, C, D

The correct answer is A, C, D. Option A: Create an AWS Config custom rule to detect configuration changes to AWS resources. Create an AWS Lambda function to remediate the AWS resources in the delegated administrator AWS account. Option C: Create a Security Hub custom action to reference in an Amazon EventBridge event rule in the delegated administrator AWS account. Option D: Create an Amazon EventBridge event rule to Invoke an AWS Lambda function that will take action on AWS resources.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Security Hub centralizes security findings and compliance checks. This option delivers the requirement at the lowest cost.

SCS-C02 Question 167

Single page →

Topic 1 · Question 167

A security engineer must Implement monitoring of a company's Amazon Aurora MySQL DB instances. The company wants to receive email notifications when unknown users try to log in to the database endpoint. Which solution will meet these requirements with the LEAST operational overhead?

AEnable Amazon GuardDuty. Enable the Amazon RDS Protection feature in GuardDuty to detect login attempts by unknown users. Create an Amazon EventBridge rule to filter GuardDuty findings. Send email notifications by using Amazon Simple Notification Service (Amazon SNS). (correct answer)
BEnable the server_audit_logglng parameter on the Aurora MySQL DB instances. Use AWS Lambda to periodically scan the delivered log files for login attempts by unknown users. Send email notifications by using Amazon Simple Notification Service (Amazon SNS).
CCreate an Amazon RDS Custom AMI. Include a third-party security agent in the AMI to detect login attempts by unknown users. Deploy RDS Custom DB instances. Migrate data from the existing installation to the RDS Custom DB instances. Configure email notifications from the third-party agent.
DWrite a stored procedure to detect login attempts by unknown users. Schedule a recurring job inside the database engine. Configure Aurora MySQL to use Amazon Simple Notification Service (Amazon SNS) to send email notifications.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Enable Amazon GuardDuty. Enable the Amazon RDS Protection feature in GuardDuty to detect login attempts by unknown users. Create an Amazon EventBridge rule to filter GuardDuty findings. Send email notifications by usi...

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

SCS-C02 Question 168

Single page →

Topic 1 · Question 168

A company runs a global ecommerce website that is hosted on AWS. The company uses Amazon CloudFront to serve content to its user base. The company wants to block inbound traffic from a specific set of countries to comply with recent data regulation policies. Which solution will meet these requirements MOST cost-effectively?

ACreate an AWS WAF web ACL with an IP match condition to deny the countries' IP ranges. Associate the web ACL with the CloudFront distribution.
BCreate an AWS WAF web ACL with a geo match condition to deny the specific countries. Associate the web ACL with the CloudFront distribution.
CUse the geo restriction feature in CloudFront to deny the specific countries. (correct answer)
DUse geolocation headers in CloudFront to deny the specific countries.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Use the geo restriction feature in CloudFront to deny the specific countries.

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins. This option delivers the requirement at the lowest cost.

SCS-C02 Question 169

Single page →

Topic 1 · Question 169

A company deploys its application as a service on an Amazon Elastic Container Service (Amazon ECS) cluster with theAWS Fargate launch type. A security engineer suspects that some incoming requests are malicious. The security engineer needs to inspect the running container by retrieving log files and memory dump flies. Which solution will meet these requirements with the LEAST operational effort?

AMigrate the application to an ECS cluster with the Amazon EC2 launch type. Configure the EC2 instances with proper remote access. Log in and inspect the container.
BUpdate the application to dump the required data to STDOUT. Use the awslogs log driver to pass the logs to Amazon CloudWatch Logs. Examine the log files in CloudWatch Logs.
CTurn on Amazon CloudWatch Container Insights for the ECS cluster. Send the log data to Amazon CloudWatch Logs by using AWS Distro for OpenTelemetry. Examine the log data in CloudWatch Logs.
DUpdate the ECS task role with AWS Systems Manager permissions. Enable the ECS Exec feature for the ECS service. Use ECS Exec to inspect the container. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Update the ECS task role with AWS Systems Manager permissions. Enable the ECS Exec feature for the ECS service. Use ECS Exec to inspect the container.

Explanation

Amazon ECS orchestrates containers and integrates natively with AWS networking and IAM. AWS Systems Manager operates and automates management of fleets of resources.

SCS-C02 Question 170

Single page →

Topic 1 · Question 170

A company uses AWS Organizations and has many AWS accounts. The company has a new requirement to use server-side encryption with customer-provided keys (SSE-C) on all new object uploads to Amazon S3 buckets.

A security engineer is creating an SCP that includes a Deny effect for the s3:PutObject action.

Which condition must the security engineer add to the SCP to enforce the new SSE-C requirement?

A (correct answer)
B
C
D

Reveal answer & explanation

Correct answer: A

The correct answer is A. Compare the policy/code shown in each option image.

SCS-C02 Question 171

Single page →

Topic 1 · Question 171

A company wants to deny a specific federated user named Bob access to an Amazon S3 bucket named DOC-EXAMPLE-BUCKET. The company wants to meet this requirement by using a bucket policy. The company also needs to ensure that this bucket policy affects Bob's S3 permissions only. Any other permissions that Bob has must remain intact.

Which policy should the company use to meet these requirements?

A
B (correct answer)
C
D

Reveal answer & explanation

Correct answer: B

The correct answer is B. Compare the policy/code shown in each option image.

SCS-C02 Question 172

Single page →

Topic 1 · Question 172

A company runs an online game on AWS. When players sign up for the game, their username and password credentials are stored in an Amazon Aurora database. The number of users has grown to hundreds of thousands of players. The number of requests for password resets and login assistance has become a burden for the company's customer service team. The company needs to implement a solution to give players another way to log in to the game. The solution must remove the burden of password resets and login assistance while securely protecting each player's credentials. Which solution will meet these requirements?

AWhen a new player signs up, use an AWS Lambda function to automatically create an IAM access key and a secret access key. Program the Lambda function to store the credentials on the player's device. Create IAM keys for existing players.
BMigrate the player credentials from the Aurora database to AWS Secrets Manager. When a new player signs up, create a key-value pair in Secrets Manager for the player’s user ID and password.
CConfigure Amazon Cognito user pools to federate access to the game with third-party identity providers (IdPs), such as social IdPs. Migrate the game’s authentication mechanism to Cognito. (correct answer)
DInstead of using usernames and passwords for authentication, issue API keys to new and existing players. Create an Amazon API Gateway API to give the game client access to the game’s functionality.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Configure Amazon Cognito user pools to federate access to the game with third-party identity providers (IdPs), such as social IdPs. Migrate the game’s authentication mechanism to Cognito.

Explanation

Amazon Cognito manages user sign-up, sign-in and federated identity for applications. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 173

Single page →

Topic 1 · Question 173

A company suspects that an attacker has exploited an overly permissive role to export credentials from Amazon EC2 instance metadata. The company uses Amazon GuardDuty and AWS Audit Manager. The company has enabled AWS CloudTrail logging and Amazon CloudWatch logging for all of its AWS accounts. A security engineer must determine if the credentials were used to access the company's resources from an external account. Which solution will provide this information?

AReview GuardDuty findings to find InstanceCredentialExfiltration events. (correct answer)
BReview assessment reports in the Audit Manager console to find InstanceCredentialExfiltration events.
CReview CloudTrail logs for GetSessionToken API calls to AWS Security Token Service (AWS STS) that come from an account ID from outside the company.
DReview CloudWatch logs for GetSessionToken API calls to AWS Security Token Service (AWS STS) that come from an account ID from outside the company.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Review GuardDuty findings to find InstanceCredentialExfiltration events.

Explanation

Amazon GuardDuty continuously monitors for threats and malicious activity.

SCS-C02 Question 174

Single page →

Topic 1 · Question 174

A security engineer needs to run an AWS CloudFormation script. The CloudFormation script builds AWS infrastructure to support a stack that includes web servers and a MySQL database. The stack has been deployed in pre-production environments and is ready for production. The production script must comply with the principle of least privilege. Additionally, separation of duties must exist between the security engineer’s IAM account and CloudFormation. Which solution will meet these requirements?

AUse IAM Access Analyzer policy generation to generate a policy that allows the CloudFormation script to run and manage the stack. Attach the policy to a new IAM role. Modify the security engineer's IAM permissions to be able to pass the new role to CloudFormation. (correct answer)
BCreate an IAM policy that allows ec2:* and rds:* permissions. Attach the policy to a new IAM role. Modify the security engineer's IAM permissions to be able to assume the new role.
CUse IAM Access Analyzer policy generation to generate a policy that allows the CloudFormation script to run and manage the stack. Modify the security engineer's IAM permissions to be able to run the CloudFormation script.
DCreate an IAM policy that allows ec2:* and rds:* permissions. Attach the policy to a new IAM role. Use the IAM policy simulator to confirm that the policy allows the AWS API calls that are necessary to build the stack. Modify the security engineer's IAM permissions to be able to pass the new role to CloudFormation.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Use IAM Access Analyzer policy generation to generate a policy that allows the CloudFormation script to run and manage the stack. Attach the policy to a new IAM role. Modify the security engineer's IAM permissions to...

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS CloudFormation provisions infrastructure as code repeatably.

SCS-C02 Question 175

Single page →

Topic 1 · Question 175 · Select all that apply

A company that uses AWS Organizations is migrating workloads to AWS. The company's application team determines that the workloads will use Amazon EC2 instances, Amazon S3 buckets, Amazon DynamoDB tables, and Application Load Balancers. For each resource type, the company mandates that deployments must comply with the following requirements: • All EC2 instances must be launched from approved AWS accounts. • All DynamoDB tables must be provisioned with a standardized naming convention. • All infrastructure that is provisioned in any accounts in the organization must be deployed by AWS CloudFormation templates. Which combination of steps should the application team take to meet these requirements? (Choose two.)

ACreate CloudFormation templates in an administrator AWS account. Share the stack sets with an application AWS account. Restrict the template to be used specifically by the application AWS account. (correct answer)
BCreate CloudFormation templates in an application AWS account. Share the output with an administrator AWS account ta review compliant resources. Restrict output to only the administrator AWS account.
CUse permissions boundaries to prevent the application AWS account from provisioning specific resources unless conditions for the internal compliance requirements are met.
DUse SCPs to prevent the application AWS account from provisioning specific resources unless conditions for the internal compliance requirements are met. (correct answer)
EActivate AWS Config managed rules for each service in the application AWS account.

Reveal answer & explanation

Correct answer: A, D

The correct answer is A, D. Option A: Create CloudFormation templates in an administrator AWS account. Share the stack sets with an application AWS account. Restrict the template to be used specifically by the application AWS account. Option D: Use SCPs to prevent the application AWS account from provisioning specific resources unless conditions for the internal compliance requirements are met.

Explanation

Service Control Policies set guardrails on what accounts in an organization can do. AWS CloudFormation provisions infrastructure as code repeatably.

SCS-C02 Question 176

Single page →

Topic 1 · Question 176 · Select all that apply

A company has a batch-processing system that uses Amazon S3, Amazon EC2, and AWS Key Management Service (AWS KMS). The system uses two AWS accounts: Account A and Account B. Account A hosts an S3 bucket that stores the objects that will be processed. The S3 bucket also stores the results of the processing. All the S3 bucket objects are encrypted by a KMS key that is managed in Account A. Account B hosts a VPC that has a fleet of EC2 instances that access the S3 bucket in Account A by using statements in the bucket policy. The VPC was created with DNS hostnames enabled and DNS resolution enabled. A security engineer needs to update the design of the system without changing any of the system's code. No AWS API calls from the batch-processing EC2 instances can travel over the internet. Which combination of steps will meet these requirements? (Choose two.)

AIn the Account B VPC, create a gateway VPC endpoint for Amazon S3. For the gateway VPC endpoint, create a resource policy that allows the s3:GetObject, s3:ListBucket, s3:PutObject, and s3:PutObjectAcl actions for the S3 bucket. (correct answer)
BIn the Account B VPC, create an interface VPC endpoint for Amazon S3. For the interface VPC endpoint, create a resource policy that allows the s3:GetObject, s3:ListBucket, s3:PutObject, and s3:PutObjectAcl actions for the S3 bucket.
CIn the Account B VPC, create an interface VPC endpoint for AWS KMS. For the interface VPC endpoint, create a resource policy that allows the kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey actions for the KMS key. Ensure that private DNS is turned on for the endpoint. (correct answer)
DIn the Account B VPC, create an interface VPC endpoint for AWS KMS. For the interface VPC endpoint, create a resource policy that allows the kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey actions for the KMS key. Ensure that private DNS is turned off for the endpoint.
EIn the Account B VPC, verify that the S3 bucket policy allows the s3:PutObjectAcl action for cross-account use. In the Account B VPC, create a gateway VPC endpoint for Amazon S3. For the gateway VPC endpoint, create a resource policy that allows the s3:GetObject, s3:ListBucket, and s3:PutObject actions for the S3 bucket.

Reveal answer & explanation

Correct answer: A, C

The correct answer is A, C. Option A: In the Account B VPC, create a gateway VPC endpoint for Amazon S3. For the gateway VPC endpoint, create a resource policy that allows the s3:GetObject, s3:ListBucket, s3:PutObject, and s3:PutObjectAcl actions for the... Option C: In the Account B VPC, create an interface VPC endpoint for AWS KMS. For the interface VPC endpoint, create a resource policy that allows the kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey actions for the KMS key. E...

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. A gateway VPC endpoint gives private, no-cost access to Amazon S3 and DynamoDB from within the VPC. A VPC endpoint provides private connectivity to AWS services without traversing the public internet.

SCS-C02 Question 177

Single page →

Topic 1 · Question 177

A security engineer is designing an IAM policy for a script that will use the AWS CLI. The script currently assumes an IAM role that is attached to three AWS managed IAM policies: AmazonEC2FullAccess, AmazonDynamoDBFullAccess, and AmazonVPCFullAccess. The security engineer needs to construct a least privilege IAM policy that will replace the AWS managed IAM policies that are attached to this role. Which solution will meet these requirements in the MOST operationally efficient way?

AIn AWS CloudTrail, create a trail for management events. Run the script with the existing AWS managed IAM policies. Use IAM Access Analyzer to generate a new IAM policy that is based on access activity in the trail. Replace the existing AWS managed IAM policies with the generated IAM policy for the role. (correct answer)
BRemove the existing AWS managed IAM policies from the role. Attach the IAM Access Analyzer Role Policy Generator to the role. Run the script. Return to IAM Access Analyzer and generate a least privilege IAM policy. Attach the new IAM policy to the role.
CCreate an account analyzer in IAM Access Analyzer. Create an archive rule that has a filter that checks whether the PrincipalArn value matches the ARN of the role. Run the script. Remove the existing AWS managed IAM policies from the role.
DIn AWS CloudTrail, create a trail for management events. Remove the existing AWS managed IAM policies from the role. Run the script. Find the authorization failure in the trail event that is associated with the script. Create a new IAM policy that includes the action and resource that caused the authorization failure. Repeat the process until the script succeeds. Attach the new IAM policy to the role.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: In AWS CloudTrail, create a trail for management events. Run the script with the existing AWS managed IAM policies. Use IAM Access Analyzer to generate a new IAM policy that is based on access activity in the trail. R...

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS CloudTrail records API activity for auditing and governance.

SCS-C02 Question 178

Single page →

Topic 1 · Question 178

A security engineer is designing a cloud architecture to support an application. The application runs on Amazon EC2 instances and processes sensitive information, including credit card numbers. The application will send the credit card numbers to a component that is running in an isolated environment. The component will encrypt, store, and decrypt the numbers. The component then will issue tokens to replace the numbers in other parts of the application. The component of the application that manages the tokenization process will be deployed on a separate set of EC2 instances. Other components of the application must not be able to store or access the credit card numbers. Which solution will meet these requirements?

AUse EC2 Dedicated Instances for the tokenization component of the application.
BPlace the EC2 instances that manage the tokenization process into a partition placement group.
CCreate a separate VPDeploy new EC2 instances into the separate VPC to support the data tokenization.
DDeploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Deploy the tokenization code onto AWS Nitro Enclaves that are hosted on EC2 instances.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SCS-C02 Question 179

Single page →

Topic 1 · Question 179

A company has two AWS accounts: Account A and Account B. Account A has an IAM role that IAM users in Account B assume when they need to upload sensitive documents to Amazon S3 buckets in Account A. A new requirement mandates that users can assume the role only if they are authenticated with multi-factor authentication (MFA). A security engineer must recommend a solution that meets this requirement with minimum risk and effort. Which solution should the security engineer recommend?

AAdd an aws:MultiFactorAuthPresent condition to the role's permissions policy.
BAdd an aws MultiFactorAuthPresent condition to the role’s trust policy. (correct answer)
CAdd an aws:MultiFactorAuthPresent condition to the session policy.
DAdd an aws:MultiFactorAuthPresent condition to the S3 bucket policies.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Add an aws MultiFactorAuthPresent condition to the role’s trust policy.

SCS-C02 Question 180

Single page →

Topic 1 · Question 180

A company wants to receive automated email notifications when AWS access keys from developer AWS accounts are detected on code repository sites. Which solution will provide the required email notifications?

ACreate an Amazon EventBridge rule to send Amazon Simple Notification Service (Amazon SNS) email notifications for Amazon GuardDuty UnauthorizedAccess:IAMUser/lnstanceCredentialExfiltration.OutsideAWS findings. (correct answer)
BChange the AWS account contact information for the Operations type to a separate email address. Periodically poll this email address for notifications.
CCreate an Amazon EventBridge rule that reacts to AWS Health events that have a value of Risk for the service category. Configure email notifications by using Amazon Simple Notification Service (Amazon SNS).
DImplement new anomaly detection software. Ingest AWS CloudTrail logs. Configure monitoring for ConsoleLogin events in the AWS Management Console. Configure email notifications from the anomaly detection software.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Create an Amazon EventBridge rule to send Amazon Simple Notification Service (Amazon SNS) email notifications for Amazon GuardDuty UnauthorizedAccess:IAMUser/lnstanceCredentialExfiltration.OutsideAWS findings.

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

Showing questions 161–180 of 307 · Page 9 of 16