Amazon SCS-C02 Online Practice Questions and Exam Preparation

Amazon SCS-C02 Online Questions & Answers

• Question 101:

  A company uses SAML federation with AWS Identity and Access Management (IAM) to provide internal users with SSO for their AWS accounts. The company's identity provider certificate was rotated as part of its normal lifecycle Shortly after

  users started receiving the following error when attempting to log in:

  "Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code: InvalidIdentityToken)"

  A security engineer needs to address the immediate issue and ensure that it will not occur again.

  Which combination of steps should the security engineer take to accomplish this? (Choose two.)

  A. Download a new copy of the SAML metadata file from the identity provider Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity.
  B. During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
  C. Download a new copy of the SAML metadata file from the identity provider. Upload the new metadata to the IAM identity provider entity configured for the SAML integration in question.
  D. During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new copy of the metadata file and create a new IAM identity provider entity. Upload the metadata file to the new IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
  E. Download a new copy of the SAML metadata file from the identity provider Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity. Update the identity provider configurations to pass a new IAM identity provider entity name in the SAML assertion.
  B. During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
  C. Download a new copy of the SAML metadata file from the identity provider. Upload the new metadata to the IAM identity provider entity configured for the SAML integration in question.

• Question 102:

  A company has two AWS accounts: Account A and Account B. Account A has an IAM role that IAM users in Account B assume when they need to upload sensitive documents to Amazon S3 buckets in Account A.

  A new requirement mandates that users can assume the role only if they are authenticated with multi-factor authentication (MFA). A security engineer must recommend a solution that meets this requirement with minimum risk and effort.

  Which solution should the security engineer recommend?

  A. Add an aws:MultiFactorAuthPresent condition to the role's permissions policy.
  B. Add an aws:MultiFactorAuthPresent condition to the role's trust policy.
  C. Add an aws:MultiFactorAuthPresent condition to the session policy.
  D. Add an aws:MultiFactorAuthPresent condition to the S3 bucket policies.
  B. Add an aws:MultiFactorAuthPresent condition to the role's trust policy.

  ---

  To ensure that IAM users in Account B can only assume a role in Account A if they are authenticated with Multi-Factor Authentication (MFA), the recommended solution is to add an aws:MultiFactorAuthPresent condition to the role's trust policy in Account A. The trust policy defines which principals (users, applications, services) can assume the role and under what conditions. By adding the aws:MultiFactorAuthPresent condition, the policy explicitly requires MFA to be present for the assume role action to succeed. This ensures that only authenticated users with MFA can assume the role, enhancing the security posture with minimal operational overhead and without modifying permissions or session policies, which could affect the role's intended capabilities.

• Question 103:

  A Security Engineer must enforce the use of only Amazon EC2, Amazon S3, Amazon RDS, Amazon DynamoDB, and IAM STS in specific accounts.

  What is a scalable and efficient approach to meet this requirement?

  

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  A. Option A

  ---

  It says specific accounts which mean specific governed OUs under your organization and you apply specific service control policy to these OUs.

• Question 104:

  An Amazon EC2 instance is denied access to a newly created IAM KMS CMK used for decrypt actions. The environment has the following configuration:

  1.

  The instance is allowed the kms:Decrypt action in its IAM role for all resources The IAM KMS CMK status is set to enabled

  2.

  The instance can communicate with the KMS API using a configured VPC endpoint What is causing the issue?

  A. The kms:GenerateDataKey permission is missing from the EC2 instance's IAM role
  B. The ARN tag on the CMK contains the EC2 instance's ID instead of the instance's ARN
  C. The kms:Encrypt permission is missing from the EC2 IAM role
  D. The KMS CMK key policy that enables IAM user permissions is missing
  D. The KMS CMK key policy that enables IAM user permissions is missing

  ---

  Explanation Explanation/Reference:In a key policy, you use "*" for the resource, which means "this CMK." A key policy applies only to the CMK it is attached to References:

• Question 105:

  Your company has been using IAM for hosting EC2 Instances for their web and database applications. They want to have a compliance check to see the following Whether any ports are left open other than admin ones like SSH and RDP

  Whether any ports to the database server other than ones from the web server security group are open Which of the following can help achieve this in the easiest way possible. You don't want to carry out an extra configuration changes?

  A. IAM Config
  B. IAM Trusted Advisor
  C. IAM Inspector D.IAMGuardDuty
  B. IAM Trusted Advisor

  ---

  Trusted Advisor checks for compliance with the following security recommendations: Limited access to common administrative ports to only a small subset of addresses. This includes ports 22 (SSH), 23 (Telnet) 3389 (RDP), and 5500 (VNQ. Limited access to common database ports. This includes ports 1433 (MSSQL Server), 1434 (MSSQL Monitor), 3306 (MySQL), Oracle (1521) and 5432 (PostgreSQL). Option A is partially correct but then you would need to write custom rules for this. The IAM trusted advisor can give you all o these checks on its dashboard Option C is incorrect. Amazon Inspector needs a software agent to be installed on all EC2 instances that are included in th. assessment target, the security of which you want to evaluate with Amazon Inspector. It monitors the behavior of the EC2 instance on which it is installed, including network, file system, and process activity, and collects a wide set of behavior and configuration data (telemetry), which it then passes to the Amazon Inspector service. Our question's requirement is to choose a choice that is easy to implement. Hence Trusted Advisor is more appropriate for this ) question. Options D is invalid because this service dont provide these details. For more information on the Trusted Advisor, please visit the following URL https://IAM.amazon.com/premiumsupport/trustedadvisor> The correct answer is: IAM Trusted Advisor Submit your Feedback/Queries to our Experts

• Question 106:

  A Security Engineer is troubleshooting a connectivity issue between a web server that is writing log files to the logging server in another VPC. The Engineer has confirmed that a peering relationship exists between the two VPCs. VPC flow logs show that requests sent from the web server are accepted by the togging server but the web server never receives a reply.

  Which of the following actions could fix this issue1?

  A. Add an inbound rule to the security group associated with the logging server that allows requests from the web server
  B. Add an outbound rule to the security group associated with the web server that allows requests to the logging server.
  C. Add a route to the route table associated with the subnet that hosts the logging server that targets the peering connection
  D. Add a route to the route table associated with the subnet that hosts the web server that targets the peering connection
  C. Add a route to the route table associated with the subnet that hosts the logging server that targets the peering connection

• Question 107:

  An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants that one particular group of IAM users should only access the test instances and not the production ones. How can the organization set that as a part of the policy?

  A. Launch the test and production instances in separate regions and allow region wise access to the group
  B. Define the IAM policy which allows access based on the instance ID
  C. Create an IAM policy with a condition which allows access to only small instances
  D. Define the tags on the test and production servers and add a condition to the IAM policy which allows access to specification tags
  D. Define the tags on the test and production servers and add a condition to the IAM policy which allows access to specification tags

  ---

  Tags enable you to categorize your IAM resources in different ways, for example, by purpose, owner, or environment. This is useful when you have many resources of the same type -- you can quickly identify a specific resource based on the tags you've assigned to it Option A is invalid because this is not a recommended practices Option B is invalid because this is an overhead to maintain this in policies Option C is invalid because the instance type will not resolve the requirement For information on resource tagging, please visit the below URL: http://docs.IAM.amazon.com/IAMEC2/latest/UserGuide/Usine_Tags.htmll The correct answer is: Define the tags on the test and production servers and add a condition to the IAM policy which allows access to specific tags Submit your Feedback/Queries to our Experts

• Question 108:

  A company runs workloads on Amazon EC2 instances. The company needs to continually scan the EC2 instances for software vulnerabilities and unintended network exposure.

  Which solution will meet these requirements?

  A. Use Amazon Inspector. Set the scan mode to hybrid scanning.
  B. Use Amazon GuardDuty. Enable the Malware Protection feature.
  C. Use Amazon Inspector. Enable the Malware Protection feature.
  D. Use Amazon GuardDuty. Enable the Runtime Monitoring feature.
  A. Use Amazon Inspector. Set the scan mode to hybrid scanning.

  ---

  Amazon Inspector is specifically designed to automatically scan Amazon EC2 instances for software vulnerabilities and unintended network exposure. By setting the scan mode to hybrid scanning, it combines continuous assessment for both vulnerabilities and network configuration issues, ensuring a thorough evaluation of EC2 instances to identify potential security risks. This solution meets the requirement of continually scanning for vulnerabilities and network exposure.

• Question 109:

  A company that uses AWS Organizations is using AWS IAM Identity Center (AWS Single Sign-On) to administer access to AWS accounts. A security engineer is creating a custom permission set in IAM Identity Center. The company will use the permission set across multiple accounts. An AWS managed policy and a customer managed policy are attached to the permission set. The security engineer has full administrative permissions and is operating in the management account.

  When the security engineer attempts to assign the permission set to an IAM Identity Center user who has access to multiple accounts, the assignment fails.

  What should the security engineer do to resolve this failure?

  A. Create the customer managed policy in every account where the permission set is assigned. Give the customer managed policy the same name and same permissions in each account.
  B. Remove either the AWS managed policy or the customer managed policy from the permission set. Create a second permission set that includes the removed policy. Apply the permission sets separately to the user.
  C. Evaluate the logic of the AWS managed policy and the customer managed policy. Resolve any policy conflicts in the permission set before deployment.
  D. Do not add the new permission set to the user. Instead, edit the user's existing permission set to include the AWS managed policy and the customer managed policy.
  A. Create the customer managed policy in every account where the permission set is assigned. Give the customer managed policy the same name and same permissions in each account.

  ---

  https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocmp.html "Before you assign your permission set with IAM policies, you must prepare your member account. The name of an IAM policy in your member account must be a case-sensitive match to name of the policy in your management account. IAM Identity Center fails to assign the permission set if the policy doesn't exist in your member account."

• Question 110:

  A global company must mitigate and respond to DDoS attacks at Layers 3, 4 and 7 All of the company's IAM applications are serverless with static content hosted on Amazon S3 using Amazon CloudFront and Amazon Route 53 Which solution will meet these requirements?

  A. Use IAM WAF with an upgrade to the IAM Business support plan
  B. Use IAM Certificate Manager with an Application Load Balancer configured with an origin access identity
  C. Use IAM Shield Advanced
  D. Use IAM WAF to protect IAM Lambda functions encrypted with IAM KMS and a NACL restricting all Ingress traffic
  C. Use IAM Shield Advanced