Amazon SCS-C01 Online Practice Questions and Exam Preparation

Amazon SCS-C01 Online Questions & Answers

• Question 111:

  A company maintains an open-source application that is hosted on a public GitHub repository. While creating a new commit to the repository, an engineer uploaded their AWS access key and secret access keys. The engineer reported the

  mistake to a manager, and the manager immediately disabled the access key.

  The company needs to assess the impact of the exposed access key. A security engineer must recommend a solution that requires the least possible managerial overhead.

  Which solution meets these requirements?

  A. Analyze an AWS Identity and Access Management (IAM) use report from AWS Trusted Advisor to see when the access key was last used.
  B. Analyze Amazon CloudWatch Logs for activity by searching for the access key.
  C. Analyze VPC flow logs for activity by searching for the access key.
  D. Analyze a credential report in AWS Identity and Access Management (IAM) to see when the access key was last used.
  D. Analyze a credential report in AWS Identity and Access Management (IAM) to see when the access key was last used.

  ---

  Explanation/Reference:

  Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html

• Question 112:

  You have a bucket and a VPC defined in AWS. You need to ensure that the bucket can only be accessed by the VPC endpoint. How can you accomplish this?

  Please select:

  A. Modify the security groups for the VPC to allow access to the 53 bucket
  B. Modify the route tables to allow access for the VPC endpoint
  C. Modify the IAM Policy for the bucket to allow access for the VPC endpoint
  D. Modify the bucket Policy for the bucket to allow access for the VPC endpoint
  D. Modify the bucket Policy for the bucket to allow access for the VPC endpoint

  ---

  Explanation/Reference:

  This is mentioned in the AWS Documentation Restricting Access to a Specific VPC Endpoint The following is an example of an S3 bucket policy that restricts access to a specific bucket, examplebucket only from the VPC endpoint with the ID vpce-la2b3c4d. The policy denies all access to the bucket if the specified endpoint is not being used. The aws:sourceVpce condition is used to the specify the endpoint. The aws:sourceVpce condition does not require an ARN for the VPC endpoint resource, only the VPC endpoint ID. For more information about using conditions in a policy, see Specifying Conditions in a Policy.

  

  Options A and B are incorrect because using Security Groups nor route tables will help to allow access specifically for that bucke via the VPC endpoint Here you specifically need to ensure the bucket policy is changed.

  Option C is incorrect because it is the bucket policy that needs to be changed and not the IAM policy.

  For more information on example bucket policies for VPC endpoints, please refer to below URL:

  https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html

  The correct answer is: Modify the bucket Policy for the bucket to allow access for the VPC endpoint

• Question 113:

  Your team is designing a web application. The users for this web application would need to sign in via an external ID provider such asfacebook or Google. Which of the following AWS service would you use for authentication? Please select:

  A. AWS Cognito
  B. AWS SAML
  C. AWS IAM
  D. AWS Config
  A. AWS Cognito

  ---

  Explanation/Reference:

  The AWS Documentation mentions the following Amazon Cognito provides authentication, authorization, and user management for your web and mobile apps.

  Your users ca sign in directly with a user name and password, or through a third party such as Facebook, Amazon, or Google. Option B is incorrect since this is used for identity federation Option C is incorrect since this is pure Identity and Access management Option D is incorrect since AWS is a configuration service For more information on AWS Cognito please refer to the below Link: https://docs.aws.amazon.com/coenito/latest/developerguide/what-is-amazon-cognito.html The correct answer is: AWS Cognito

• Question 114:

  A Security Architect is evaluating managed solutions for storage of encryption keys. The requirements are:

  -Storage is accessible by using only VPCs.

  -Service has tamper-evident controls.

  -Access logging is enabled.

  -Storage has high availability.

  Which of the following services meets these requirements?

  A. Amazon S3 with default encryption
  B. AWS CloudHSM
  C. Amazon DynamoDB with server-side encryption
  D. AWS Systems Manager Parameter Store
  B. AWS CloudHSM

• Question 115:

  A Security Engineer creates an Amazon S3 bucket policy that denies access to all users. A few days later, the Security Engineer adds an additional statement to the bucket policy to allow read-only access to one other employee. Even after updating the policy, the employee still receives an access denied message.

  What is the likely cause of this access denial?

  A. The ACL in the bucket needs to be updated.
  B. The IAM policy does not allow the user to access the bucket
  C. It takes a few minutes for a bucket policy to take effect
  D. The allow permission is being overridden by the deny.
  B. The IAM policy does not allow the user to access the bucket

  ---

  Explanation/Reference:

  Reference: https://aws.amazon.com/premiumsupport/knowledge-center/s3-access-denied-bucket-policy/

• Question 116:

  Your company has a hybrid environment, with on-premise servers and servers hosted in the AWS cloud. They are planning to use the Systems Manager for patching servers. Which of the following is a pre-requisite for this to work;

  Please select:

  A. Ensure that the on-premise servers are running on Hyper-V.
  B. Ensure that an IAM service role is created
  C. Ensure that an IAM User is created
  D. Ensure that an IAM Group is created for the on-premise servers
  B. Ensure that an IAM service role is created

  ---

  Explanation/Reference:

  You need to ensure that an IAM service role is created for allowing the on- premise servers to communicate with the AWS Systems Manager. Option A is incorrect since it is not necessary that servers should only be running Hyper-V Options C and D are incorrect since it is not necessary that IAM users and groups are created For more information on the Systems Manager role please refer to the below URL: com/systems-rnanaeer/latest/usereuide/sysman-! The correct answer is: Ensure that an IAM service role is created

• Question 117:

  A company plans to use AWS CodeDeploy to deploy code to multiple Amazon EC2 instances in a VPC at the same time. The company needs to allow the CodeDeploy service to communicate with the instances in the VPC without going through the public internet for CodeDeploy API operations.

  What should a security engineer do to meet this requirement?

  A. Use a NAT gateway in the VPC.
  B. Use an interface VPC endpoint for CodeDeploy API operations.
  C. Use a gateway VPC endpoint for CodeDeploy API operations.
  D. Use a VPN connection to the VPC.
  C. Use a gateway VPC endpoint for CodeDeploy API operations.

  ---

  Explanation/Reference:

• Question 118:

  A company has set up EC2 instances on the AW5 Cloud. There is a need to see all the IP addresses which are accessing the EC2 Instances. Which service can help achieve this?

  Please select:

  A. Use the AWS Inspector service
  B. Use AWS VPC Flow Logs
  C. Use Network ACL's
  D. Use Security Groups
  B. Use AWS VPC Flow Logs

  ---

  Explanation/Reference:

  The AWS Documentation mentions the foil A flow log record represents a network flow in your flow log. Each record captures the network flow for a specific 5-tuple, for a specific capture window. A 5-tuple is a set of five different values that

  specify the source, destination, and protocol for an internet protocol (IP) flow.

  Options A,C and D are all invalid because these services/tools cannot be used to get the the IP addresses which are accessing the EC2 Instances For more information on VPC Flow Logs please visit the URL https://docs.aws.amazon.com/

  AmazonVPC/latest/UserGuide/flow-logs.html The correct answer is: Use AWS VPC Flow Logs

• Question 119:

  A company is outsourcing its operational support 1o an external company. The company's security officer must implement an access solution fen delegating operational support that minimizes overhead. Which approach should the security officer take to meet these requirements?

  A. implement Amazon Cognito identity pools with a role that uses a policy that denies the actions related to Amazon Cognito API management Allow the external company to federate through its identity provider
  B. Federate AWS identity and Access Management (IAM) with the external company's identity provider Create an IAM role and attach a policy with the necessary permissions
  C. Create an IAM group for me external company Add a policy to the group that denies IAM modifications Securely provide the credentials to the eternal company.
  D. Use AWS SSO with the external company's identity provider. Create an IAM group to map to the identity provider user group, and attach a policy with the necessary permissions.
  B. Federate AWS identity and Access Management (IAM) with the external company's identity provider Create an IAM role and attach a policy with the necessary permissions

• Question 120:

  An organization has tens of applications deployed on thousands of Amazon EC2 instances. During testing, the Application team needs information to let them know whether the network access control lists (network ACLs) and security groups are working as expected.

  How can the Application team's requirements be met?

  A. Turn on VPC Flow Logs, send the logs to Amazon S3, and use Amazon Athena to query the logs.
  B. Install an Amazon Inspector agent on each EC2 instance, send the logs to Amazon S3, and use Amazon EMR to query the logs.
  C. Create an AWS Config rule for each network ACL and security group configuration, send the logs to Amazon S3, and use Amazon Athena to query the logs.
  D. Turn on AWS CloudTrail, send the trails to Amazon S3, and use AWS Lambda to query the trails.
  A. Turn on VPC Flow Logs, send the logs to Amazon S3, and use Amazon Athena to query the logs.