Amazon SCS-C02 Online Practice Questions and Exam Preparation

Amazon SCS-C02 Online Questions & Answers

• Question 611:

  You need to create a Linux EC2 instance in IAM. Which of the following steps is used to ensure secure authentication the EC2 instance from a windows machine? Choose 2 answers from the options given below.

  A. Ensure to create a strong password for logging into the EC2 Instance
  B. Create a key pair using putty
  C. Use the private key to log into the instance
  D. Ensure the password is passed securely using SSL
  B. Create a key pair using putty
  C. Use the private key to log into the instance

  ---

  The IAM Documentation mentions the following You can use Amazon EC2 to create your key pair. Alternatively, you could use a third-party tool and then import the public key to Amazon EC2. Each key pair requires a name. Be sure to choose a name that is easy to remember. Amazon EC2 associates the public key with the name that you specify as the key name. Amazon EC2 stores the public key only, and you store the private key. Anyone who possesses your private key can decrypt login information, so it's important that you store your private keys in a secure place. Options A and D are incorrect since you should use key pairs for secure access to Ec2 Instances For more information on EC2 key pairs, please refer to below URL: https://docs.IAM.amazon.com/IAMEC2/latest/UserGuide/ec2-key-pairs.html The correct answers are: Create a key pair using putty. Use the private key to log into the instance Submit your Feedback/Queries to our Experts

• Question 612:

  Your company is planning on hosting an internal network in IAM. They want machines in the VPC to authenticate using private certificates. They want to minimize the work and maintenance in working with certificates. What is the ideal way to fulfil this requirement.

  A. Consider using Windows Server 2016 Certificate Manager
  B. Consider using IAM Certificate Manager
  C. Consider using IAM Access keys to generate the certificates
  D. Consider using IAM Trusted Advisor for managing the certificates
  B. Consider using IAM Certificate Manager

  ---

  Explanation Explanation/Reference:The IAM Documentation mentions the following ACM is tightly linked with IAM Certificate Manager Private Certificate Authority. You can use ACM PCA to create a private certificate authority (CA) and then use ACM to issue private certificates. These are SSL/TLS X.509 certificates that identify users, computers, applications, services, servers, and other devices internally. Private certificates cannot be publicly trusted Option A is partially invalid. Windows Server 2016 Certificate Manager can be used but since there is a requirement to "minimize the work and maintenance", IAM Certificate Manager should be used Option C and D are invalid because these cannot be used for managing certificates. For more information on ACM, please visit the below URL: https://docs.IAM.amazon.com/acm/latest/userguide/acm-overview.html The correct answer is: Consider using IAM Certificate Manager Submit your Feedback/Queries to our Experts

• Question 613:

  A company is hosting multiple applications within a single VPC in its IAM account. The applications are running behind an Application Load Balancer that is associated with an IAM WAF web ACL. The company's security team has identified that multiple port scans are originating from a specific range of IP addresses on the internet.

  A security engineer needs to deny access from the offending IP addresses.

  Which solution will meet these requirements?

  A. Modify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests from the IP address range.
  B. Add a rule to all security groups to deny the incoming requests from the IP address range.
  C. Modify the AWS WAF web ACL with a rate-based rule statement to deny the incoming requests from the IP address range.
  D. Configure the AWS WAF web ACL with regex match conditions. Specify a pattern set to deny the incoming requests based on the match condition.
  A. Modify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests from the IP address range.

  ---

  Note that the IP is known and the question wants us to deny access from that particular address and so we can use IP set match policy of WAF to block access.

• Question 614:

  A company has recently recovered from a security incident that required the restoration of Amazon EC2 instances from snapshots.

  After performing a gap analysis of its disaster recovery procedures and backup strategies, the company is concerned that, next time, it will not be able to recover the EC2 instances if the AWS account is compromised and Amazon EBS

  snapshots are deleted.

  All EBS snapshots are encrypted using an AWS KMS CMK.

  Which solution would solve this problem?

  A. Create a new Amazon S3 bucket. Use EBS lifecycle policies to move EBS snapshots to the new S3 bucket. Move snapshots to Amazon S3 Glacier using lifecycle policies, and apply Glacier Vault Lock policies to prevent deletion.
  B. Use AWS Systems Manager to distribute a configuration that performs local backups of all attached disks to Amazon S3.
  C. Create a new AWS account with limited privileges. Allow the new account to access the AWS KMS key used to encrypt the EBS snapshots, and copy the encrypted snapshots to the new account on a recurring basis.
  D. Use AWS Backup to copy EBS snapshots to Amazon S3.
  C. Create a new AWS account with limited privileges. Allow the new account to access the AWS KMS key used to encrypt the EBS snapshots, and copy the encrypted snapshots to the new account on a recurring basis.

• Question 615:

  A company has configured a gateway VPC endpoint in a VPC. Only Amazon EC2 instances that reside in a single subnet in the VPC can use the endpoint. The company has modified the route table for this single subnet to route traffic to Amazon S3 through the gateway VPC endpoint. The VPC provides internet access through an internet gateway.

  A security engineer attempts to use instance profile credentials from an EC2 instance to retrieve an object from the S3 bucket, but the attempt fails. The security engineer verifies that the EC2 instance has an IAM instance profile with the correct permissions to access the S3 bucket and to retrieve objects. The security engineer also verifies that the S3 bucket policy is allowing access properly. Additionally, the security engineer verifies that the EC2 instance's security group and the subnet's network ACLs allow the communication.

  What else should the security engineer check to determine why the request from the EC2 instance is failing?

  A. Verify that the EC2 instance's security group does not have an implicit inbound deny rule for Amazon S3.
  B. Verify that the VPC endpoint's security group does not have an explicit inbound deny rule for the EC2 instance.
  C. Verify that the internet gateway is allowing traffic to Amazon S3.
  D. Verify that the VPC endpoint policy is allowing access to Amazon S3.
  B. Verify that the VPC endpoint's security group does not have an explicit inbound deny rule for the EC2 instance.

  ---

  The VPC endpoint for Amazon S3 can have an associated VPC endpoint policy that controls what actions are allowed through the endpoint. Even though the instance profile, security group, and network ACLs are correctly configured, if the VPC endpoint policy is too restrictive or incorrectly configured, it could block access to S3. The security engineer should verify that the VPC endpoint policy allows the necessary actions for the EC2 instance to access the S3 bucket.

• Question 616:

  A company runs an application that sends logs to a log group in Amazon CloudWatch Logs. The email addresses of the application users are in the logs.

  The company's developers need to view the logs in CloudWatch Logs. A security engineer must ensure that the developers who access the log group cannot see the user email addresses.

  Which solution will meet this requirement?

  A. Use Amazon Macie to scan the log group. Configure Macie to use a custom data identifier that uses a regular expression to identify an email address pattern. Activate automated data discovery in Macie.
  B. Create an AWS Key Management Service (AWS KMS) key. Configure the log group to use the key to encrypt the logs. Configure the key policy to deny access to the IAM role that the developers assume to use CloudWatch Logs.
  C. Create a subscription filter for the log group. Configure the log subscription to send the log data to an AWS Lambda function. Program the Lambda function to parse the log entries and to mask values that are email addresses.
  D. Configure a data protection policy for the log group. Specify the AWS managed data identifier of EmailAddress for the type of data to mask. Activate data protection for the log group.
  D. Configure a data protection policy for the log group. Specify the AWS managed data identifier of EmailAddress for the type of data to mask. Activate data protection for the log group.

  ---

  Explanation Explanation/Reference:Amazon CloudWatch Logs supports data protection policies that can mask sensitive information such as email addresses in log groups. By configuring a data protection policy for the log group and specifying the AWS managed data identifier for EmailAddress, the company can automatically mask email addresses in the logs, allowing developers to access the log data without seeing the email addresses.

• Question 617:

  A company needs a forensic-logging solution for hundreds of applications running in Docker on Amazon EC2 The solution must perform real-time analytics on the togs must support the replay of messages and must persist the logs.

  Which IAM services should be used to meet these requirements? (Select TWO)

  A. Amazon Athena
  B. Amazon Kinesis
  C. Amazon SQS
  D. Amazon Elasticsearch
  E. Amazon EMR
  B. Amazon Kinesis
  D. Amazon Elasticsearch

• Question 618:

  A company that uses AWS Organizations is migrating workloads to AWS. The compa-nys application team determines that the workloads will use Amazon EC2 instanc-es, Amazon S3 buckets, Amazon DynamoDB tables, and Application Load Balancers. For each resource type, the company mandates that deployments must comply with the following requirements:

  1.

  All EC2 instances must be launched from approved AWS accounts.

  2.

  All DynamoDB tables must be provisioned with a standardized naming convention.

  3.

  All infrastructure that is provisioned in any accounts in the organization must be deployed by AWS CloudFormation templates.

  Which combination of steps should the application team take to meet these re-quirements? (Select TWO.)

  A. Create CloudFormation templates in an administrator AWS account. Share the stack sets with an application AWS account. Restrict the template to be used specifically by the application AWS account.
  B. Create CloudFormation templates in an application AWS account. Share the output with an administrator AWS account to review compliant resources. Restrict output to only the administrator AWS account.
  C. Use permissions boundaries to prevent the application AWS account from provisioning specific resources unless conditions for the internal compli-ance requirements are met.
  D. Use SCPs to prevent the application AWS account from provisioning specific resources unless conditions for the internal compliance requirements are met.
  E. Activate AWS Config managed rules for each service in the application AWS account.
  A. Create CloudFormation templates in an administrator AWS account. Share the stack sets with an application AWS account. Restrict the template to be used specifically by the application AWS account.
  D. Use SCPs to prevent the application AWS account from provisioning specific resources unless conditions for the internal compliance requirements are met.

• Question 619:

  A security engineer has enabled IAM Security Hub in their IAM account, and has enabled the Center for internet Security (CIS) IAM Foundations compliance standard. No evaluation results on compliance are returned in the Security Hub console after several hours. The engineer wants to ensure that Security Hub can evaluate their resources for CIS IAM Foundations compliance.

  Which steps should the security engineer take to meet these requirements?

  A. Add full Amazon Inspector IAM permissions to the Security Hub service role to allow it to perform the CIS compliance evaluation
  B. Ensure that IAM Trusted Advisor Is enabled in the account and that the Security Hub service role has permissions to retrieve the Trusted Advisor security-related recommended actions
  C. Ensure that IAM Config. is enabled in the account, and that the required IAM Config rules have been created for the CIS compliance evaluation
  D. Ensure that the correct trail in IAM CloudTrail has been configured for monitoring by Security Hub and that the Security Hub service role has permissions to perform the GetObject operation on CloudTrails Amazon S3 bucket
  A. Add full Amazon Inspector IAM permissions to the Security Hub service role to allow it to perform the CIS compliance evaluation

• Question 620:

  The Security Engineer is managing a web application that processes highly sensitive personal information. The application runs on Amazon EC2. The application has strict compliance requirements, which instruct that all incoming traffic to the application is protected from common web exploits and that all outgoing traffic from the EC2 instances is restricted to specific whitelisted URLs.

  Which architecture should the Security Engineer use to meet these requirements?

  A. Use IAM Shield to scan inbound traffic for web exploits. Use VPC Flow Logs and IAM Lambda to restrict egress traffic to specific whitelisted URLs.
  B. Use IAM Shield to scan inbound traffic for web exploits. Use a third-party IAM Marketplace solution to restrict egress traffic to specific whitelisted URLs.
  C. Use IAM WAF to scan inbound traffic for web exploits. Use VPC Flow Logs and IAM Lambda to restrict egress traffic to specific whitelisted URLs.
  D. Use IAM WAF to scan inbound traffic for web exploits. Use a third-party IAM Marketplace solution to restrict egress traffic to specific whitelisted URLs.
  D. Use IAM WAF to scan inbound traffic for web exploits. Use a third-party IAM Marketplace solution to restrict egress traffic to specific whitelisted URLs.

  ---

  Explanation Explanation/Reference:IAM Shield is mainly for DDos Attacks.IAM WAF is mainly for some other types of attacks like Injection and XSS etcIn this scenario, It seems it is WAF functionality that is needed.VPC logs do show the source and destination IP and Port , they never show any URL .. because URL are level 7 while VPC are concerned about lover network levels. https://docs.IAM.amazon.com/vpc/latest/userguide/flow-logs.html