Amazon SCS-C02 Online Practice Questions and Exam Preparation

Amazon SCS-C02 Online Questions & Answers

• Question 811:

  A company has set up the following structure to ensure that their S3 buckets always have logging enabled

  

  If there are any changes to the configuration to an S3 bucket, a config rule gets checked. If logging is disabled , then Lambda function is invoked. This Lambda function will again enable logging on the S3 bucket. Now there is an issue being encoutered with the entire flow. You have verified that the Lambda function is being invoked. But when logging is disabled for the bucket, the lambda function does not enable it again. Which of the following could be an issue

  A. The IAM Config rule is not configured properly
  B. The IAM Lambda function does not have appropriate permissions for the bucket
  C. The IAM Lambda function should use Node.js instead of python.
  D. You need to also use the API gateway to invoke the lambda function
  B. The IAM Lambda function does not have appropriate permissions for the bucket

  ---

  The most probable cause is that you have not allowed the Lambda functions to have the appropriate permissions on the S3 bucket to make the relevant changes. Option A is invalid because this is more of a permission instead of a configuration rule issue. Option C is invalid because changing the language will not be the core solution. Option D is invalid because you don't necessarily need to use the API gateway service For more information on accessing resources from a Lambda function, please refer to below URL https://docs.IAM.amazon.com/lambda/latest/ds/accessing-resources.htmll The correct answer is: The IAM Lambda function does not have appropriate permissions for the bucket Submit your Feedback/Queries to our Experts

• Question 812:

  An organization has a system in IAM that allows a large number of remote workers to submit data files. File sizes vary from a few kilobytes to several megabytes. A recent audit highlighted a concern that data files are not encrypted while in transit over untrusted networks.

  Which solution would remediate the audit finding while minimizing the effort required?

  A. Upload an SSL certificate to IAM, and configure Amazon CloudFront with the passphrase for the private key.
  B. Call KMS.Encrypt() in the client, passing in the data file contents, and call KMS.Decrypt() server-side.
  C. Use IAM Certificate Manager to provision a certificate on an Elastic Load Balancing in front of the web service's servers.
  D. Create a new VPC with an Amazon VPC VPN endpoint, and update the web service's DNS record.
  C. Use IAM Certificate Manager to provision a certificate on an Elastic Load Balancing in front of the web service's servers.

• Question 813:

  Which option for the use of the IAM Key Management Service (KMS) supports key management best practices that focus on minimizing the potential scope of data exposed by a possible future key compromise?

  A. Use KMS automatic key rotation to replace the master key, and use this new master key for future encryption operations without re-encrypting previously encrypted data.
  B. Generate a new Customer Master Key (CMK), re-encrypt all existing data with the new CMK, and use it for all future encryption operations.
  C. Change the CMK alias every 90 days, and update key-calling applications with the new key alias.
  D. Change the CMK permissions to ensure that individuals who can provision keys are not the same individuals who can use the keys.
  A. Use KMS automatic key rotation to replace the master key, and use this new master key for future encryption operations without re-encrypting previously encrypted data.

  ---

  "automatic key rotation has no effect on the data that the CMK protects. It does not rotate the data keys that the CMK generated or re-encrypt any data protected by the CMK, and it will not mitigate the effect of a compromised data key. You might decide to create a new CMK and use it in place of the original CMK. This has the same effect as rotating the key material in an existing CMK, so it's often thought of as manually rotating the key." https://docs.aws.amazon.com/kms/ latest/developerguide/rotate-keys.html https://docs.IAM.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys- manually for IAM standards

• Question 814:

  You have a vendor that needs access to an IAM resource. You create an IAM user account. You want to restrict access to the resource using a policy for just that user over a brief period. Which of the following would be an ideal policy to use?

  A. An IAM Managed Policy
  B. An Inline Policy
  C. A Bucket Policy
  D. A bucket ACL
  B. An Inline Policy

  ---

  The IAM Documentation gives an example on such a case Inline policies are useful if you want to maintain a strict one-to-one relationship between a policy and the principal entity that if s applied to. For example, you want to be sure that the permissions in a policy are not inadvertently assigned to a principal entity other than the one they're intended for. When you use an inline policy, the permissions in the policy cannot be inadvertently attached to the wrong principal entity. In addition, when you use the IAM Management Console to delete that principal entit the policies embedded in the principal entity are deleted as well. That's because they are part of the principal entity. Option A is invalid because IAM Managed Polices are ok for a group of users, but for individual users, inline policies are better. Option C and D are invalid because they are specifically meant for access to S3 buckets For more information on policies, please visit the following URL: https://docs.IAM.amazon.com/IAM/latest/UserGuide/access managed-vs-inline The correct answer is: An Inline Policy Submit your Feedback/Queries to our Experts

• Question 815:

  A security engineer needs to develop a process to investigate and respond to po-tential security events on a company's Amazon EC2 instances. All the EC2 in-stances are backed by Amazon Elastic Block Store (Amazon EBS). The company uses AWS Systems Manager to manage all the EC2 instances and has installed Systems Manager Agent (SSM Agent) on all the EC2 instances.

  The process that the security engineer is developing must comply with AWS secu-rity best practices and must meet the following requirements:

  1.

  A compromised EC2 instance's volatile memory and non-volatile memory must be preserved for forensic purposes.

  2.

  A compromised EC2 instance's metadata must be updated with corresponding inci-dent ticket information.

  3.

  A compromised EC2 instance must remain online during the investigation but must be isolated to prevent the spread of malware.

  4.

  Any investigative activity during the collection of volatile data must be cap-tured as part of the process.

  Which combination of steps should the security engineer take to meet these re-quirements with the LEAST operational overhead? (Select THREE.)

  A. Gather any relevant metadata for the compromised EC2 instance. Enable ter-mination protection. Isolate the instance by updating the instance's secu-rity groups to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing (ELB) resources.
  B. Gather any relevant metadata for the compromised EC2 instance. Enable ter-mination protection. Move the instance to an isolation subnet that denies all source and destination traffic. Associate the instance with the subnet to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing (ELB) resources.
  C. Use Systems Manager Run Command to invoke scripts that collect volatile data.
  D. Establish a Linux SSH or Windows Remote Desktop Protocol (RDP) session to the compromised EC2 instance to invoke scripts that collect volatile data.
  E. Create a snapshot of the compromised EC2 instance's EBS volume for follow-up investigations. Tag the instance with any relevant metadata and inci-dent ticket information.
  F. Create a Systems Manager State Manager association to generate an EBS vol-ume snapshot of the compromised EC2 instance. Tag the instance with any relevant metadata and incident ticket information.
  A. Gather any relevant metadata for the compromised EC2 instance. Enable ter-mination protection. Isolate the instance by updating the instance's secu-rity groups to restrict access. Detach the instance from any Auto Scaling groups that the instance is a member of. Deregister the instance from any Elastic Load Balancing (ELB) resources.
  C. Use Systems Manager Run Command to invoke scripts that collect volatile data.
  E. Create a snapshot of the compromised EC2 instance's EBS volume for follow-up investigations. Tag the instance with any relevant metadata and inci-dent ticket information.

• Question 816:

  A company has hired a third-party security auditor, and the auditor needs read-only access to all IAM resources and logs of all VPC records and events that have occurred on IAM. How can the company meet the auditor's requirements without comprising security in the IAM environment? Choose the correct answer from the options below

  A. Create a role that has the required permissions for the auditor.
  B. Create an SNS notification that sends the CloudTrail log files to the auditor's email when CIoudTrail delivers the logs to S3, but do not allow the auditor access to the IAM environment.
  C. The company should contact IAM as part of the shared responsibility model, and IAM will grant required access to th^ third-party auditor.
  D. Enable CloudTrail logging and create an IAM user who has read-only permissions to the required IAM resources, including the bucket containing the CloudTrail logs.
  D. Enable CloudTrail logging and create an IAM user who has read-only permissions to the required IAM resources, including the bucket containing the CloudTrail logs.

  ---

  IAM CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your IAM account. With CloudTrail, you can log, continuously monitor, and retain events related to API calls across your IAM infrastructure. CloudTrail provides a history of IAM API calls for your account including API calls made through the IAM Management Console, IAM SDKs, command line tools, and other IAM services. This history simplifies security analysis, resource change tracking, and troubleshooting. Option A and C are incorrect since Cloudtrail needs to be used as part of the solution Option B is incorrect since the auditor needs to have access to Cloudtrail For more information on cloudtrail, please visit the below URL: https://IAM.amazon.com/cloudtraiL The correct answer is: Enable CloudTrail logging and create an IAM user who has read- only permissions to the required IAM resources, including the bucket containing the CloudTrail logs. Submit your Feedback/Queries to our Experts

• Question 817:

  Your development team is using access keys to develop an application that has access to S3 and DynamoDB. A new security policy has outlined that the credentials should not be older than 2 months, and should be rotated. How can you achieve this?

  A. Use the application to rotate the keys in every 2 months via the SDK
  B. Use a script to query the creation date of the keys. If older than 2 months, create new access key and update all applications to use it inactivate the old key and delete it.
  C. Delete the user associated with the keys after every 2 months. Then recreate the user again.
  D. Delete the IAM Role associated with the keys after every 2 months. Then recreate the IAM Role again.
  B. Use a script to query the creation date of the keys. If older than 2 months, create new access key and update all applications to use it inactivate the old key and delete it.

  ---

  One can use the CLI command list-access-keys to get the access keys. This command also returns the "CreateDate" of the keys. If the CreateDate is older than 2 months, then the keys can be deleted. The Returns list-access-keys CLI command returns information about the access key IDs associated with the specified IAM user. If there are none, the action returns an empty list Option A is incorrect because you might as use a script for such maintenance activities Option C is incorrect because you would not rotate the users themselves Option D is incorrect because you don't use IAM roles for such a purpose For more information on the CLI command, please refer to the below Link: http://docs.IAM.amazon.com/cli/latest/reference/iam/list-access-keys.htmll The correct answer is: Use a script to query the creation date of the keys. If older than 2 months, create new access key and update all applications to use it inactivate the old key and delete it. Submit your Feedback/Queries to our Experts

• Question 818:

  An employee keeps terminating EC2 instances on the production environment. You've determined the best way to ensure this doesn't happen is to add an extra layer of defense against terminating the instances. What is the best method to ensure the employee does not terminate the production instances? Choose the 2 correct answers from the options below

  A. Tag the instance with a production-identifying tag and add resource-level permissions to the employee user with an explicit deny on the terminate API call to instances with the production tag. <
  B. Tag the instance with a production-identifying tag and modify the employees group to allow only start stop, and reboot API calls and not the terminate instance call.
  C. Modify the IAM policy on the user to require MFA before deleting EC2 instances and disable MFA access to the employee
  D. Modify the IAM policy on the user to require MFA before deleting EC2 instances
  A. Tag the instance with a production-identifying tag and add resource-level permissions to the employee user with an explicit deny on the terminate API call to instances with the production tag. <
  B. Tag the instance with a production-identifying tag and modify the employees group to allow only start stop, and reboot API calls and not the terminate instance call.

  ---

  Tags enable you to categorize your IAM resources in different ways, for example, by purpose, owner, or environment. This is useful when you have many resources of the same type -- you can quickly identify a specific resource based on the tags you've assigned to it. Each tag consists of a key and an optional value, both of which you define Options CandD are incorrect because it will not ensure that the employee cannot terminate the instance. For more information on tagging answer resources please refer to the below URL: http://docs.IAM.amazon.com/IAMEC2/latest/UserGuide/Usins_Tags.htmll The correct answers are: Tag the instance with a production-identifying tag and add resource-level permissions to the employe user with an explicit deny on the terminate API call to instances with the production tag.. Tag the instance with a production-identifying tag and modify the employees group to allow only start stop, and reboot API calls and not the terminate instance Submit your Feedback/ Queries to our Experts

• Question 819:

  A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon EC2 instance that hosts the company's primary website. The GuardDuty finding received read:

  UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.

  The security engineer confirmed that a malicious actor used API access keys intended for the EC2 instance from a country where the company does not operate. The security engineer needs to deny access to the malicious actor.

  What is the first step the security engineer should take?

  A. Open the EC2 console and remove any security groups that allow inbound traffic from 0.0.0.0/0.
  B. Install the AWS Systems Manager Agent on the EC2 instance and run an inventory report.
  C. Install the Amazon Inspector agent on the host and run an assessment with the CVE rules package.
  D. Open the IAM console and revoke all IAM sessions that are associated with the instance profile.
  D. Open the IAM console and revoke all IAM sessions that are associated with the instance profile.

  ---

  Explanation Explanation/Reference:The alert indicates that a malicious actor has used the instance credentials to access AWS services. To mitigate this threat, the first step should be to revoke all active IAM sessions associated with the instance profile. This action will effectively disconnect the malicious user from AWS services by invalidating the credentials, regardless of their location. After this step, further analysis and remediation can be performed.

• Question 820:

  Development teams in your organization use S3 buckets to store the log files for various applications hosted ir development environments in IAM. The developers want to keep the logs for one month for troubleshooting purposes, and then purge the logs. What feature will enable this requirement?

  A. Adding a bucket policy on the S3 bucket.
  B. Configuring lifecycle configuration rules on the S3 bucket.
  C. Creating an IAM policy for the S3 bucket.
  D. Enabling CORS on the S3 bucket.
  B. Configuring lifecycle configuration rules on the S3 bucket.

  ---

  The IAM Documentation mentions the following on lifecycle policies Lifecycle configuration enables you to specify the lifecycle management of objects in a bucket. The configuration is a set of one or more rules, where each rule defines an action for Amazon S3 to apply to a group of objects. These actions can be classified a?follows: Transition actions - In which you define when objects transition to another . For example, you may choose to transition objects to the STANDARDJA (IA, for infrequent access) storage class 30 days after creation, or archive objects to the GLACIER storage class one year after creation. Expiration actions - In which you specify when the objects expire. Then Amazon S3 deletes the expired objects on your behalf. Option A and C are invalid because neither bucket policies neither IAM policy's can control the purging of logs Option D is invalid CORS is used for accessing objects across domains and not for purging of logs For more information on IAM S3 Lifecycle policies, please visit the following URL: com/AmazonS3/latest/d< The correct answer is: Configuring lifecycle configuration rules on the S3 bucket. Submit your Feedback/Queries to our Experts