Amazon SCS-C02 Online Practice Questions and Exam Preparation

Amazon SCS-C02 Online Questions & Answers

• Question 91:

  A Security Engineer is looking for a way to control access to data that is being encrypted under a CMK. The Engineer is also looking to use additional authenticated data (AAD) to prevent tampering with ciphertext. Which action would provide the required functionality?

  A. Pass the key alias to IAM KMS when calling Encrypt and Decrypt API actions.
  B. Use IAM policies to restrict access to Encrypt and Decrypt API actions.
  C. Use kms:EncryptionContext as a condition when defining IAM policies for the CMK.
  D. Use key policies to restrict access to the appropriate IAM groups.
  C. Use kms:EncryptionContext as a condition when defining IAM policies for the CMK.

  ---

  Explanation Explanation/Reference:https://IAM.amazon.com/blogs/security/how-to-protect-the-integrity-of-your- encrypted-data-by-using-IAM-key-management-service-and-encryptioncontext/ One of the most important and critical concepts in IAM Key Management Service (KMS) for advanced and secure data usage is EncryptionContext. Using EncryptionContext properly can help significantly improve the security of your applications. EncryptionContext is a key- value map (both strings) that is provided to KMS with each encryption and decryption request. EncryptionContext provides three benefits: Additional authenticated data (AAD), Audit trail, Authorization context

• Question 92:

  A web application runs in a VPC on EC2 instances behind an ELB Application Load Balancer. The application stores data in an RDS MySQL DB instance. A Linux bastion host is used to apply schema updates to the database - administrators connect to the host via SSH from a corporate workstation. The following security groups are applied to the infrastructure

  1.

  sgLB - associated with the ELB

  2.

  sgWeb - associated with the EC2 instances.

  3.

  sgDB - associated with the database

  4.

  sgBastion - associated with the bastion host

  Which security group configuration will allow the application to be secure and functional?

  A. sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from 0.0.0.0/0 sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the corporate IP address range
  B. sgLB :aIlow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgLB sgBastion: allow port 22 traffic from the VPC IP address range
  C. sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the VPC IP address range
  D. sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the corporate IP address range
  D. sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the corporate IP address range

  ---

  The Load Balancer should accept traffic on ow port 80 and 443 traffic from 0.0.0.0/0 The backend EC2 Instances should accept traffic from the Load Balancer The database should allow traffic from the Web server And the Bastion host should only allow traffic from a specific corporate IP address range Option A is incorrect because the Web group should only allow traffic from the Load balancer For more information on IAM Security Groups, please refer to below URL: https://docs.IAM.amazon.com/IAMEC2/latest/UserGuide/usins-network-security.htmll The correct answer is: sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the corporate IP address range Submit your Feedback/Queries to our Experts

• Question 93:

  Your company has just started using IAM and created an IAM account. They are aware of the potential issues when root access is enabled. How can they best safeguard the account when it comes to root access? Choose 2 answers fro the options given below

  A. Delete the root access account
  B. Create an Admin IAM user with the necessary permissions
  C. Change the password for the root account.
  D. Delete the root access keys
  B. Create an Admin IAM user with the necessary permissions
  D. Delete the root access keys

  ---

  The IAM Documentation mentions the following All IAM accounts have root user credentials (that is, the credentials of the account owner). These credentials allow full access to all resources in the account. Because you cant restrict permissions for root user credentials, we recommend that you delete your root user access keys. Then create IAM Identity and Access Management (IAM) user credentials for everyday interaction with IAM. Option A is incorrect since you cannot delete the root access account Option C is partially correct but cannot be used as the ideal solution for safeguarding the account For more information on root access vs admin IAM users, please refer to below URL: https://docs.IAM.amazon.com/eeneral/latest/er/root-vs-iam.html The correct answers are: Create an Admin IAM user with the necessary permissions. Delete the root access keys Submit your Feedback/Queries to our Experts

• Question 94:

  A company's security team has defined a set of IAM Config rules that must be enforced globally in all IAM accounts the company owns. What should be done to provide a consolidated compliance overview for the security team?

  A. Use IAM Organizations to limit IAM Config rules to the appropriate Regions, and then consolidate the Amazon CloudWatch dashboard into one IAM account.
  B. Use IAM Config aggregation to consolidate the views into one IAM account, and provide role access to the security team.
  C. Consolidate IAM Config rule results with an IAM Lambda function and push data to Amazon SQS. Use Amazon SNS to consolidate and alert when some metrics are triggered.
  D. Use Amazon GuardDuty to load data results from the IAM Config rules compliance status, aggregate GuardDuty findings of all IAM accounts into one IAM account, and provide role access to the security team.
  B. Use IAM Config aggregation to consolidate the views into one IAM account, and provide role access to the security team.

• Question 95:

  A company uses AWS Config rules to identify Amazon S3 buckets that are not compliant with the company's data protection policy. The S3 buckets are hosted in several AWS Regions and several AWS accounts. The accounts are in an organization in AWS Organizations.

  The company needs a solution to remediate the organization's existing noncompliant S3 buckets and any noncompliant S3 buckets that are created in the future.

  Which solution will meet these requirements?

  A. Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.
  B. Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
  C. Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.
  D. Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
  A. Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.

  ---

  An AWS Config aggregator with organization-wide aggregation enables centralized visibility and monitoring of compliance for all accounts and Regions within the organization. By combining this with an AWS Lambda function that automatically remediates noncompliant S3 buckets (either by reconfiguring them to meet the policy or deleting them if necessary), this solution provides an automated and scalable way to handle both existing and future noncompliant buckets across the entire organization. This setup meets the requirement to remediate both current and newly created noncompliant S3 buckets.

• Question 96:

  A company has an organization in AWS Organizations. The organization consists of multiple OUs. The company must prevent IAM principals from outside the organization from accessing the organization's Amazon S3 buckets. The solution must not affect the existing access that the OUs have to the S3 buckets.

  Which solution will meet these requirements?

  A. Configure S3 Block Public Access for all S3 buckets.
  B. Configure S3 Block Public Access for all AWS accounts.
  C. Deploy an SCP that includes the "aws:ResourceOrgPaths": "${aws:PrincipalOrgPaths}" condition.
  D. Deploy an SCP that includes the "aws:ResourceOrgID": "${aws:PrincipalOrgID}" condition.
  D. Deploy an SCP that includes the "aws:ResourceOrgID": "${aws:PrincipalOrgID}" condition.

  ---

  Explanation Explanation/Reference:By using an SCP with the aws:ResourceOrgID and aws:PrincipalOrgID condition, you ensure that only IAM principals from within the same AWS Organization can access the S3 buckets. This SCP restricts access from any IAM principals outside the organization while allowing access within the organization. This approach meets the requirement without affecting existing permissions within the OUs.

• Question 97:

  An application developer is using an IAM Lambda function that must use IAM KMS to perform encrypt and decrypt operations for API keys that are less than 2 KB Which key policy would allow the application to do this while granting least privilege?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  C. Option C

• Question 98:

  You have enabled Cloudtrail logs for your company's IAM account. In addition, the IT Security department has mentioned that the logs need to be encrypted. How can this be achieved?

  Please select:

  A. Enable SSL certificates for the Cloudtrail logs
  B. There is no need to do anything since the logs will already be encrypted
  C. Enable Server side encryption for the trail
  D. Enable Server side encryption for the destination S3 bucket
  B. There is no need to do anything since the logs will already be encrypted

  ---

  The IAM Documentation mentions the following. By default CloudTrail event log files are encrypted using Amazon S3 server-side encryption (SSE). You can also choose to encryption your log files with an IAM Key Management Service (IAM KMS) key. You can store your log files in your bucket for as long as you want. You can also define Amazon S3 lifecycle rules to archive or delete log files automatically. If you want notifications about lo file delivery and validation, you can set up Amazon SNS notifications. Option A.C and D are not valid since logs will already be encrypted For more information on how Cloudtrail works, please visit the following URL: https://docs.IAM.amazon.com/IAMcloudtrail/latest/usereuide/how-cloudtrail-works.htmll The correct answer is: There is no need to do anything since the logs will already be encrypted Submit your Feedback/Queries to our Experts

• Question 99:

  A company uses Amazon EC2 Linux instances in the AWS Cloud. A member of the company's security team recently received a report about common vulnerability identifiers on the instances.

  A security engineer needs to verify patching and perform remediation if the instances do not have the correct patches installed. The security engineer must determine which EC2 instances are at risk and must implement a solution to

  automatically update those instances with the applicable patches.

  What should the security engineer do to meet these requirements?

  A. Use AWS Systems Manager Patch Manager to view vulnerability identifiers for missing patches on the instances. Use Patch Manager also to automate the patching process.
  B. Use AWS Shield Advanced to view vulnerability identifiers for missing patches on the instances. Use AWS Systems Manager Patch Manager to automate the patching process.
  C. Use Amazon GuardDuty to view vulnerability identifiers for missing patches on the instances. Use Amazon Inspector to automate the patching process.
  D. Use Amazon Inspector to view vulnerability identifiers for missing patches on the instances. Use Amazon Inspector also to automate the patching process.
  A. Use AWS Systems Manager Patch Manager to view vulnerability identifiers for missing patches on the instances. Use Patch Manager also to automate the patching process.

  ---

  https://aws.amazon.com/about-aws/whats-new/2020/10/now-use-aws- systems-manager-to-view-vulnerability-identifiers-for-missing-patches-on-your-linux- instances/

• Question 100:

  You have an EC2 instance with the following security configured:

  1.

  ICMP inbound allowed on Security Group

  2.

  ICMP outbound not configured on Security Group

  3.

  ICMP inbound allowed on Network ACL

  4.

  ICMP outbound denied on Network ACL

  If Flow logs is enabled for the instance, which of the following flow records will be recorded? Choose 3 answers from the options give below

  A. An ACCEPT record for the request based on the Security Group
  B. An ACCEPT record for the request based on the NACL
  C. A REJECT record for the response based on the Security Group
  D. A REJECT record for the response based on the NACL
  A. An ACCEPT record for the request based on the Security Group
  B. An ACCEPT record for the request based on the NACL
  D. A REJECT record for the response based on the NACL

  ---

  This example is given in the IAM documentation as well For example, you use the ping command from your home computer (IP address is 203.0.113.12) to your instance (the network interface's private IP address is 172.31.16.139). Your security group's inbound rules allow ICMP traffic and the outbound rules do not allow ICMP traffic however, because security groups are stateful, the response ping from your instance is allowed. Your network ACL permits inbound ICMP traffic but does not permit outbound ICMP traffic. Because network ACLs are stateless, the response ping is dropped and will not reach your home computer. In a flow log, this is displayed as 2 flow log records: An ACCEPT record for the originating ping that was allowed by both the network ACL and the security group, and therefore was allowed to reach your instance. A REJECT record for the response ping that the network ACL denied. Option C is invalid because the REJECT record would not be present For more information on Flow Logs, please refer to the below URL: http://docs.IAM.amazon.com/AmazonVPC/latest/UserGuide/flow-loes.html The correct answers are: An ACCEPT record for the request based on the Security Group, An ACCEPT record for the request based on the NACL, A REJECT record for the response based on the NACL Submit your Feedback/Queries to our Experts