Amazon SCS-C02 Online Practice Questions and Exam Preparation

Amazon SCS-C02 Online Questions & Answers

• Question 451:

  There is a set of Ec2 Instances in a private subnet. The application hosted on these EC2 Instances need to access a DynamoDB table. It needs to be ensured that traffic does not flow out to the internet. How can this be achieved?

  A. Use a VPC endpoint to the DynamoDB table
  B. Use a VPN connection from the VPC
  C. Use a VPC gateway from the VPC
  D. Use a VPC Peering connection to the DynamoDB table
  A. Use a VPC endpoint to the DynamoDB table

  ---

  The following diagram from the IAM Documentation shows how you can access the DynamoDB service from within a V without going to the Internet This can be done with the help of a VPC endpoint Option B is invalid because this is used for connection between an on-premise solution and IAM Option C is invalid because there is no such option Option D is invalid because this is used to connect 2 VPCs For more information on VPC endpointsfor DynamoDB, please visit the URL: The correct answer is: Use a VPC endpoint to the DynamoDB table Submit your Feedback/Queries to our Experts

• Question 452:

  An organization has a multi-petabyte workload that it is moving to Amazon S3, but the CISO is concerned about cryptographic wear-out and the blast radius if a key is compromised. How can the CISO be assured that IAM KMS and Amazon S3 are addressing the concerns? (Select TWO )

  A. There is no API operation to retrieve an S3 object in its encrypted form.
  B. Encryption of S3 objects is performed within the secure boundary of the KMS service.
  C. S3 uses KMS to generate a unique data key for each individual object.
  D. Using a single master key to encrypt all data includes having a single place to perform audits and usage validation.
  E. The KMS encryption envelope digitally signs the master key during encryption to prevent cryptographic wear-out
  C. S3 uses KMS to generate a unique data key for each individual object.
  E. The KMS encryption envelope digitally signs the master key during encryption to prevent cryptographic wear-out

• Question 453:

  You are planning to use IAM Configto check the configuration of the resources in your IAM account. You are planning on using an existing IAM role and using it for the IAM Config resource. Which of the following is required to ensure the IAM config service can work as required?

  A. Ensure that there is a trust policy in place for the IAM Config service within the role
  B. Ensure that there is a grant policy in place for the IAM Config service within the role
  C. Ensure that there is a user policy in place for the IAM Config service within the role
  D. Ensure that there is a group policy in place for the IAM Config service within the role
  A. Ensure that there is a trust policy in place for the IAM Config service within the role

  ---

  Options B,C and D are invalid because you need to ensure a trust policy is in place and not a grant, user or group policy or more information on the IAM role permissions please visit the below Link: https://docs.IAM.amazon.com/config/latest/developerguide/iamrole-permissions.htmll The correct answer is: Ensure that there is a trust policy in place for the IAM Config service within the role Submit your Feedback/Queries to our Experts

• Question 454:

  A company has thousands of AWS Lambda functions. While reviewing the Lambda functions, a security engineer discovers that sensitive information is being stored in environment variables and is viewable as plaintext in the Lambda console. The values of the sensitive information are only a few characters long.

  What is the MOST cost-effective way to address this security issue?

  A. Set up IAM policies from the Lambda console to hide access to the environment variables.
  B. Use AWS Step Functions to store the environment variables. Access the environment variables at runtime. Use IAM permissions to restrict access to the environment variables to only the Lambda functions that require access.
  C. Store the environment variables in AWS Secrets Manager, and access them at runtime. Use IAM permissions to restrict access to the secrets to only the Lambda functions that require access.
  D. Store the environment variables in AWS Systems Manager Parameter Store as secure string parameters, and access them at runtime. Use IAM permissions to restrict access to the parameters to only the Lambda functions that require access.
  D. Store the environment variables in AWS Systems Manager Parameter Store as secure string parameters, and access them at runtime. Use IAM permissions to restrict access to the parameters to only the Lambda functions that require access.

  ---

  Storing sensitive information in environment variables is not a secure practice, as anyone who has access to the Lambda console or the Lambda function code can view them as plaintext. To address this security issue, the security engineer needs to use a service that can store and encrypt the environment variables, and access them at runtime using IAM permissions. The most cost-effective way to do this is to use AWS Systems Manager Parameter Store, which is a service that provides secure, hierarchical storage for configuration data management and secrets management. Parameter Store allows you to store values as standard parameters (plaintext) or secure string parameters (encrypted). Secure string parameters use a AWS Key Management Service (AWS KMS) customer master key (CMK) to encrypt the parameter value. To access the parameter value at runtime, the Lambda function needs to have IAM permissions to decrypt the parameter using the KMS CMK. The other options are incorrect because: Option A is incorrect because setting up IAM policies from the Lambda console to hide access to the environment variables will not prevent someone who has access to the Lambda function code from viewing them as plaintext. IAM policies can only control who can perform actions on AWS resources, not what they can see in the code or the console. Option B is incorrect because using AWS Step Functions to store the environment variables is not a secure or cost-effective solution. AWS Step Functions is a service that lets you coordinate multiple AWS services into serverless workflows. Step Functions does not provide any encryption or secrets management capabilities, and it will incur additional charges for each state transition in the workflow. Moreover, storing environment variables in Step Functions will make them visible in the execution history of the workflow, which can be accessed by anyone who has permission to view the Step Functions console or API. Option C is incorrect because storing the environment variables in AWS Secrets Manager and accessing them at runtime is not a cost-effective solution. AWS Secrets Manager is a service that helps you protect secrets needed to access your applications, services, and IT resources. Secrets Manager enables you to rotate, manage, and retrieve secrets throughout their lifecycle. While Secrets Manager can securely store and encrypt environment variables using KMS CMKs, it will incur higher charges than Parameter Store for storing and retrieving secrets. Unless the security engineer needs the advanced features of Secrets Manager, such as automatic rotation of secrets or integration with other AWS services, Parameter Store is a cheaper and simpler option.

• Question 455:

  A company has an application hosted in an Amazon EC2 instance and wants the application to access secure strings stored in IAM Systems Manager Parameter Store When the application tries to access the secure string key value, it fails. Which factors could be the cause of this failure? (Select TWO.)

  A. The EC2 instance role does not have decrypt permissions on the IAM Key Management Sen/ice (IAM KMS) key used to encrypt the secret
  B. The EC2 instance role does not have read permissions to read the parameters In Parameter Store
  C. Parameter Store does not have permission to use IAM Key Management Service (IAM KMS) to decrypt the parameter
  D. The EC2 instance role does not have encrypt permissions on the IAM Key Management Service (IAM KMS) key associated with the secret
  E. The EC2 instance does not have any tags associated.
  A. The EC2 instance role does not have decrypt permissions on the IAM Key Management Sen/ice (IAM KMS) key used to encrypt the secret
  B. The EC2 instance role does not have read permissions to read the parameters In Parameter Store

  ---

  Explanation Explanation/Reference:https://docs.IAM.amazon.com/systems-manager/latest/userguide/sysman- paramstore-access.html

• Question 456:

  A company requires that data stored in IAM be encrypted at rest. Which of the following approaches achieve this requirement? Select 2 answers from the options given below.

  A. When storing data in Amazon EBS, use only EBS-optimized Amazon EC2 instances.
  B. When storing data in EBS, encrypt the volume by using IAM KMS.
  C. When storing data in Amazon S3, use object versioning and MFA Delete.
  D. When storing data in Amazon EC2 Instance Store, encrypt the volume by using KMS.
  E. When storing data in S3, enable server-side encryption.
  B. When storing data in EBS, encrypt the volume by using IAM KMS.
  E. When storing data in S3, enable server-side encryption.

  ---

  The IAM Documentation mentions the following To create an encrypted Amazon EBS volume, select the appropriate box in the Amazon EBS section of the Amazon EC2 console. You can use a custom customer master key (CMK) by choosing one from the list that appears below the encryption box. If you do not specify a custom CMK, Amazon EBS uses the IAM-managed CMK for Amazon EBS in your account. If there is no IAM-managed CMK for Amazon EBS in your account, Amazon EBS creates one. Data protection refers to protecting data while in-transit (as it travels to and from Amazon S3) and at rest (while it is stored on disks in Amazon S3 data centers). You can protect data in transit by using SSL or by using client-side encryption. You have the following options of protecting data at rest in Amazon S3. ?Use Server-Side Encryption - You request Amazon S3 to encrypt your object before saving it on disks in its data centers and decrypt it when you download the objects. ?Use Client-Side Encryption - You can encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools. Option A is invalid because using EBS-optimized Amazon EC2 instances alone will not guarantee protection of instances at rest. Option C is invalid because this will not encrypt data at rest for S3 objects. Option D is invalid because you don't store data in Instance store. For more information on EBS encryption, please visit the below URL: https://docs.IAM.amazon.com/kms/latest/developerguide/services-ebs.html For more information on S3 encryption, please visit the below URL: https://docs.IAM.amazon.com/AmazonS3/latest/dev/UsinEEncryption.html The correct answers are: When storing data in EBS, encrypt the volume by using IAM KMS. When storing data in S3, enable server-side encryption. Submit your Feedback/Queries to our Experts

• Question 457:

  Your company is planning on IAM on hosting its IAM resources. There is a company policy which mandates that all security keys are completely managed within the company itself. Which of the following is the correct measure of following this policy?

  A. Using the IAM KMS service for creation of the keys and the company managing the key lifecycle thereafter.
  B. Generating the key pairs for the EC2 Instances using puttygen
  C. Use the EC2 Key pairs that come with IAM
  D. Use S3 server-side encryption
  B. Generating the key pairs for the EC2 Instances using puttygen

  ---

  y ensuring that you generate the key pairs for EC2 Instances, you will have complete control of the access keys. Options A,C and D are invalid because all of these processes means that IAM has ownership of the keys. And the question specifically mentions that you need ownership of the keys For information on security for Compute Resources, please visit the below URL: https://d1.IAMstatic.com/whitepapers/Security/Security Compute Services Whitepaper.pdfl The correct answer is: Generating the key pairs for the EC2 Instances using puttygen Submit your Feedback/Queries to our Experts

• Question 458:

  A company has retail stores The company is designing a solution to store scanned copies of customer receipts on Amazon S3 Files will be between 100 KB and 5 MB in PDF format Each retail store must have a unique encryption key Each object must be encrypted with a unique key

  Which solution will meet these requirements?

  A. Create a dedicated AWS Key Management Service (AWS KMS) customer managed key for each retail store Use the S3 Put operation to upload the objects to Amazon S3 Specify server-side encryption with AWS KMS keys (SSE-KMS) and the key ID of the store's key
  B. Create a new AWS Key Management Service (AWS KMS) customer managed key every day for each retail store Use the KMS Encrypt operation to encrypt objects Then upload the objects to Amazon S3
  C. Run the AWS Key Management Service (AWS KMS) GenerateDataKey operation every day for each retail store Use the data key and client-side encryption to encrypt the objects Then upload the objects to Amazon S3
  D. Use the AWS Key Management Service (AWS KMS) ImportKeyMaterial operation to import new key material to AWS KMS every day for each retail store Use a customer managed key and the KMS Encrypt operation to encrypt the objects Then upload the objects to Amazon S3
  A. Create a dedicated AWS Key Management Service (AWS KMS) customer managed key for each retail store Use the S3 Put operation to upload the objects to Amazon S3 Specify server-side encryption with AWS KMS keys (SSE-KMS) and the key ID of the store's key

  ---

  To meet the requirements of storing scanned copies of customer receipts on Amazon S3, where files will be between 100 KB and 5 MB in PDF format, each retail store must have a unique encryption key, and each object must be encrypted with a unique key, the most appropriate solution would be to create a dedicated AWS Key Management Service (AWS KMS) customer managed key for each retail store. Then, use the S3 Put operation to upload the objects to Amazon S3, specifying server-side encryption with AWS KMS keys (SSE-KMS) and the key ID of the store's key. References: : Amazon S3 - Amazon Web Services : AWS Key Management Service - Amazon Web Services : Amazon S3 - Amazon Web Services : AWS Key Management Service - Amazon Web Services

• Question 459:

  A company had developed an incident response plan 18 months ago. Regular implementations of the response plan are carried out. No changes have been made to the response plan have been made since its creation. Which of the following is a right statement with regards to the plan?

  A. It places too much emphasis on already implemented security controls.
  B. The response plan is not implemented on a regular basis
  C. The response plan does not cater to new services
  D. The response plan is complete in its entirety
  C. The response plan does not cater to new services

  ---

  So definitely the case here is that the incident response plan is not catering to newly created services. IAM keeps on changing and adding new services and hence the response plan must cater to these new services. Option A and B are invalid because we don't know this for a fact. Option D is invalid because we know that the response plan is not complete, because it does not cater to new features of IAM For more information on incident response plan please visit the following URL: https://IAM.amazon.com/blogs/publicsector/buildins-a-cloud-specific-incident-response- plan; The correct answer is: The response plan does not cater to new services Submit your Feedback/Queries to our Experts

• Question 460:

  A company needs to retain tog data archives for several years to be compliant with regulations. The tog data is no longer used but It must be retained

  What Is the MOST secure and cost-effective solution to meet these requirements?

  A. Archive the data to Amazon S3 and apply a restrictive bucket policy to deny the s3 DeleteOotect API
  B. Archive the data to Amazon S3 Glacier and apply a Vault Lock policy
  C. Archive the data to Amazon S3 and replicate it to a second bucket in a second IAM Region Choose the S3 Standard-Infrequent Access (S3 Standard-1A) storage class and apply a restrictive bucket policy to deny the s3 DeleteObject API
  D. Migrate the log data to a 16 T8 Amazon Elastic Block Store (Amazon EBS) volume Create a snapshot of the EBS volume
  B. Archive the data to Amazon S3 Glacier and apply a Vault Lock policy