An employee keeps terminating EC2 instances on the production environment. You've determined the best way to ensure this doesn't happen is to add an extra layer of defense against terminating the instances. What is the best method to ensure the employee does not terminate the production instances? Choose the 2 correct answers from the options below Please select:

Tag the instance with a production-identifying tag and add resource-level permissions to the employee user with an explicit deny on the terminate API call to instances with the production tag.

Tag the instance with a production-identifying tag and modify the employees group to allow only start stop, and reboot API calls and not the terminate instance call.

Tag the instance with a production-identifying tag and add resource-level permissions to the employee user with an explicit deny on the terminate API call to instances with the production tag.

Tag the instance with a production-identifying tag and modify the employees group to allow only start stop, and reboot API calls and not the terminate instance call.

Modify the IAM policy on the user to require MFA before deleting EC2 instances and disable MFA access to the employee

Modify the IAM policy on the user to require MFA before deleting EC2 instances

You have been given a new brief from your supervisor for a client who needs a web application set up on AWS. The a most important requirement is that MySQL must be used as the database, and this database must not be hosted in t« public cloud, but rather at the client's data center due to security risks. Which of the following solutions would be the ^ best to assure that the client's requirements are met? Choose the correct answer from the options below Please select:

Build the application server on a public subnet and the database at the client's data center.Connect them with a VPN connection which uses IPsec.

Use the public subnet for the application server and use RDS with a storage gateway to access and synchronize the data securely from the local data center.

Build the application server on a public subnet and the database on a private subnet with a NAT instance between them.

Build the application server on a public subnet and build the database in a private subnet with a secure ssh connection to the private subnet from the client's data center.

A company has been using the AW5 KMS service for managing its keys. They are planning on carrying out housekeeping activities and deleting keys which are no longer in use. What are the ways that can be incorporated to see which keys are in use? Choose 2 answers from the options given below Please select:

See who is assigned permissions to the master key

See Cloudtrail for usage of the key

Determine the age of the master key

See who is assigned permissions to the master key

See Cloudtrail for usage of the key

Use AWS cloudwatch events for events generated for the key

Which of the following is the correct sequence of how KMS manages the keys when used along with the Redshift cluster service Please select:

The master keys encrypts the cluster key. The cluster key encrypts the database key. The database key encrypts the data encryption keys.

The master keys encrypts the database key. The database key encrypts the data encryption keys.

The master keys encrypts the data encryption keys. The data encryption keys encrypts the database key

The master keys encrypts the cluster key, database key and data encryption keys

A company wants to use Cloudtrail for logging all API activity. They want to segregate the logging of data events and management events. How can this be achieved? Choose 2 answers from the options given below Please select:

Create one trail that logs data events to an S3 bucket

Create another trail that logs management events to another S3 bucket

Create one Cloudtrail log group for data events

Create one trail that logs data events to an S3 bucket

Create another trail that logs management events to another S3 bucket

Create another Cloudtrail log group for management events

Your company has been using AWS for the past 2 years. They have separate S3 buckets for logging the various AWS services that have been used. They have hired an external vendor for analyzing their log files. They have their own AWS account. What is the best way to ensure that the partner account can access the log files in the company account for analysis. Choose 2 answers from the options given below Please select:

Create an IAM Role in the company account

Ensure the IAM Role has access for read-only to the S3 buckets

Create an IAM user in the company account

Create an IAM Role in the company account

Ensure the IAM user has access for read-only to the S3 buckets

Ensure the IAM Role has access for read-only to the S3 buckets

A company is planning on using AWS for hosting their applications. They want complete separation and isolation of their production , testing and development environments. Which of the following is an ideal way to design such a setup? Please select:

Use separate AWS accounts for each of the environments

Use separate VPCs for each of the environments

Use separate IAM Roles for each of the environments

Use separate IAM Policies for each of the environments

Use separate AWS accounts for each of the environments

An application is designed to run on an EC2 Instance. The applications needs to work with an S3 bucket. From a security perspective , what is the ideal way for the EC2 instance/ application to be configured? Please select:

Assign an IAM Role and assign it to the EC2 Instance

Use the AWS access keys ensuring that they are frequently rotated.

Assign an IAM user to the application that has specific access to only that S3 bucket

Assign an IAM Role and assign it to the EC2 Instance

Assign an IAM group and assign it to the EC2 Instance

Your company has an EC2 Instance hosted in AWS. This EC2 Instance hosts an application. Currently this application is experiencing a number of issues. You need to inspect the network packets to see what the type of error that is occurring? Which one of the below steps can help address this issue?Please select:

Use a network monitoring tool provided by an AWS partner.

Use another instance. Setup a port to "promiscuous mode" and sniff the traffic to analyze the packets. -

A company hosts critical data in an S3 bucket. Even though they have assigned the appropriate permissions to the bucket, they are still worried about data deletion. What measures can be taken to restrict the risk of data deletion on the bucket. Choose 2 answers from the options given below Please select:

Enable versioning on the S3 bucket

Enable MFA Delete in the bucket policy

Enable versioning on the S3 bucket

Enable data at rest for the objects in the bucket

Enable MFA Delete in the bucket policy

Enable data in transit for the objects in the bucket

You company has mandated that all data in AWS be encrypted at rest. How can you achieve this for EBS volumes? Choose 2 answers from the options given below Please select:

Use Windows bit locker for EBS volumes on Windows instances

Use TrueEncrypt for EBS volumes on Linux instances

Use Windows bit locker for EBS volumes on Windows instances

Use TrueEncrypt for EBS volumes on Linux instances

Use AWS Systems Manager to encrypt the existing EBS volumes

Boot EBS volume can be encrypted during launch without using custom AMI

You are designing a connectivity solution between on-premises infrastructure and Amazon VPC. Your server's on-premises will be communicating with your VPC instances. You will be establishing IPSec tunnels over the internet. Yo will be using VPN gateways and terminating the IPsec tunnels on AWSsupported customer gateways. Which of the following objectives would you achieve by implementing an IPSec tunnel as outlined above? Choose 4 answers form the options below Please select:

Data encryption across the internet

Protection of data in transit over the Internet

Peer identity authentication between VPN gateway and customer gateway

Data integrity protection across the Internet

End-to-end protection of data in transit

End-to-end Identity authentication

Data encryption across the internet

Protection of data in transit over the Internet

Peer identity authentication between VPN gateway and customer gateway

Data integrity protection across the Internet

A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet with port 80 and a Database server in the private subnet with port 3306. The user is configuring a security group for the public subnet (WebSecGrp) and the private subnet (DBSecGrp). which of the below mentioned entries is required in the private subnet database security group DBSecGrp?Please select:

Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp.

Allow Inbound on port 3306 from source 20.0.0.0/16

Allow Outbound on port 3306 for Destination Web Server Security Group WebSecGrp.

Allow Outbound on port 80 for Destination NAT Instance IP

A user has enabled versioning on an S3 bucket. The user is using server side encryption for data at Rest. If the user is supplying his own keys for encryption SSE-C, which of the below mentioned statements is true? Please select:

It is possible to have different encryption keys for different versions of the same object

The user should use the same encryption key for all versions of the same object

It is possible to have different encryption keys for different versions of the same object

AWS S3 does not allow the user to upload his own keys for server side encryption

The SSE-C does not work when versioning is enabled

You are planning to use AWS Configto check the configuration of the resources in your AWS account.You are planning on using an existing IAM role and using it for the AWS Config resource. Which of the following is required to ensure the AWS config service can work as required? Please select:

Ensure that there is a trust policy in place for the AWS Config service within the role

Ensure that there is a grant policy in place for the AWS Config service within the role

Ensure that there is a user policy in place for the AWS Config service within the role

Ensure that there is a group policy in place for the AWS Config service within the role

Your developer is using the KMS service and an assigned key in their Java program. They get the below error when running the code arn:aws:iam::113745388712:user/UserB is not authorized to perform: kms:DescribeKey Which of the following could help resolve the issue?Please select:

Ensure that UserB is given the right permissions in the Key policy

Ensure that UserB is given the right IAM role to access the key

Ensure that UserB is given the right permissions in the IAM policy

Ensure that UserB is given the right permissions in the Key policy

Ensure that UserB is given the right permissions in the Bucket policy

Your company has an external web site. This web site needs to access the objects in an S3 bucket.Which of the following would allow the web site to access the objects in the most secure manner?Please select:

Use the aws:Referer key in the condition clause for the bucket policy

Grant public access for the bucket via the bucket policy

Use the aws:Referer key in the condition clause for the bucket policy

Use the aws:sites key in the condition clause for the bucket policy

Grant a role that can be assumed by the web site

Your IT Security team has identified a number of vulnerabilities across critical EC2 Instances in the company's AWS Account. Which would be the easiest way to ensure these vulnerabilities are remediated? Please select:

Use AWS Systems Manager to patch the servers

Create AWS Lambda functions to download the updates and patch the servers.

Use AWS CLI commands to download the updates and patch the servers.

Use AWS inspector to patch the servers

Use AWS Systems Manager to patch the servers

An organization has launched 5 instances: 2 for production and 3 for testing. The organization wants that one particular group of IAM users should only access the test instances and not the production ones. How can the organization set that as a part of the policy?Please select:

Define the tags on the test and production servers and add a condition to the IAM policy which allows access to specification tags

Launch the test and production instances in separate regions and allow region wise access to the group

Define the IAM policy which allows access based on the instance ID

Create an IAM policy with a condition which allows access to only small instances

Define the tags on the test and production servers and add a condition to the IAM policy which allows access to specification tags

Your company is planning on AWS on hosting its AWS resources. There is a company policy which mandates that all security keys are completely managed within the company itself. Which of the following is the correct measure of following this policy?Please select:

Generating the key pairs for the EC2 Instances using puttygen

Using the AWS KMS service for creation of the keys and the company managing the key lifecycle thereafter.

Generating the key pairs for the EC2 Instances using puttygen

Use the EC2 Key pairs that come with AWS

A company has a set of EC2 instances hosted in AWS. These instances have EBS volumes for storing critical information. There is a business continuity requirement and in order to boost the agility of the business and to ensure data durability which of the following options are not required.Please select:

Use lifecycle policies for the EBS volumes

The CFO of a company wants to allow one of his employees to view only the AWS usage report page.Which of the below mentioned IAM policy statements allows the user to have access to the AWS usage report page? Please select:

"Effect': "Allow", "Action": ["aws-portal:ViewUsage"," aws-portal:ViewBilling"], "Resource": "*"

"Effect": "Allow". "Action": ["Describe"], "Resource": "Billing"

"Effect": "Allow", "Action": ["AccountUsage], "Resource": "*"

"Effect': "Allow", "Action": ["aws-portal:ViewUsage"," aws-portal:ViewBilling"], "Resource": "*"

"Effect": "Allow", "Action": ["aws-portal: ViewBilling"], "Resource": "*"

Your company has the following setup in AWS a. A set of EC2 Instances hosting a web application b. An application load balancer placed in front of the EC2 Instances There seems to be a set of malicious requests coming from a set of IP addresses. Which of the following can be used to protect against these requests?Please select:

Use AWS WAF to block the IP addresses

Use Security Groups to block the IP addresses

Use VPC Flow Logs to block the IP addresses

Use AWS inspector to block the IP addresses

Use AWS WAF to block the IP addresses

An organization has setup multiple IAM users. The organization wants that each IAM user accesses the IAM console only within the organization and not from outside. How can it achieve this? Please select:

Create an IAM policy with a condition which denies access when the IP address range is not from the organization

Create an IAM policy with the security group and use that security group for AWS console login

Create an IAM policy with a condition which denies access when the IP address range is not from the organization

Configure the EC2 instance security group which allows traffic only from the organization's IP range

Create an IAM policy with VPC and allow a secure gateway between the organization and AWS Console

You are creating a Lambda function which will be triggered by a Cloudwatch Event. The data from these events needs to be stored in a DynamoDB table. How should the Lambda function be given access to the DynamoDB table? Please select:

Use an IAM role which has permissions to the DynamoDB table and attach it to the Lambda function.

Put the AWS Access keys in the Lambda function since the Lambda function by default is secure

Use an IAM role which has permissions to the DynamoDB table and attach it to the Lambda function.

Use the AWS Access keys which has access to DynamoDB and then place it in an S3 bucket.

Create a VPC endpoint for the DynamoDB table. Access the VPC endpoint from the Lambda function.

There is a set of Ec2 Instances in a private subnet. The application hosted on these EC2 Instances need to access a DynamoDB table. It needs to be ensured that traffic does not flow out to the internet. How can this be achieved?Please select:

Use a VPC endpoint to the DynamoDB table

Use a VPN connection from the VPC

Use a VPC Peering connection to the DynamoDB table

A company has a requirement to create a DynamoDB table. The company's software architect has provided the following CLI command for the DynamoDB table Which of the following has been taken of from a security perspective from the above command?Please select:

The above command ensures data encryption at rest for the Customer table

Since the ID is hashed, it ensures security of the underlying table.

The above command ensures data encryption at rest for the Customer table

The above command ensures data encryption in transit for the Customer table

The right throughput has been specified from a security perspective

You need to establish a secure backup and archiving solution for your company, using AWS.Documents should be immediately accessible for three months and available for five years for compliance reasons. Which AWS service fulfills these requirements in the most cost-effective way?

Upload data to S3 and use lifecycle policies to move the data into Glacier for long-term archiving.

Upload the data on EBS, use lifecycle policies to move EBS snapshots into S3 and later into Glacier for long-term archiving.

Use Direct Connect to upload data to S3 and use IAM policies to move the data into Glacier for long-term archiving.

Use Storage Gateway to store data to S3 and use lifecycle policies to move the data into Redshift for long-term archiving.

What is the result of the following bucket policy?

It will deny all access to the bucket mybucket

It will allow all access to the bucket mybucket

It will allow the user mark from AWS account number 111111111 all access to the bucket but deny everyone else all access to the bucket

It will deny all access to the bucket mybucket

Your company is planning on using AWS EC2 and ELB for deployment for their web applications. The security policy mandates that all traffic should be encrypted. Which of the following options will ensure that this requirement is met. Choose 2 answers from the options below.Please select:

Ensure the load balancer listens on port 443

Ensure the HTTPS listener sends requests to the instances on port 443

Ensure the load balancer listens on port 80

Ensure the load balancer listens on port 443

Ensure the HTTPS listener sends requests to the instances on port 443

Ensure the HTTPS listener sends requests to the instances on port 80

Your company is hosting a set of EC2 Instances in AWS. They want to have the ability to detect if any port scans occur on their AWS EC2 Instances. Which of the following can help in this regard? Please select:

Use AWS Guard Duty to monitor any malicious port scans

Use AWS inspector to consciously inspect the instances for port scans

Use AWS Trusted Advisor to notify of any malicious port scans

Use AWS Config to notify of any malicious port scans

Use AWS Guard Duty to monitor any malicious port scans

You have an Amazon VPC that has a private subnet and a public subnet in which you have a NAT instance server. You have created a group of EC2 instances that configure themselves at startup by downloading a bootstrapping script from S3 that deploys an application via GIT.Which one of the following setups would give us the highest level of security?Choose the correct answer from the options given below.Please select:

EC2 instances in our private subnet, no EIPs, route outgoing traffic via the NAT

EC2 instances in our public subnet, no EIPs, route outgoing traffic via the IGW

EC2 instances in our public subnet, assigned EIPs, and route outgoing traffic via the NAT

EC2 instance in our private subnet, assigned EIPs, and route our outgoing traffic via our IGW

EC2 instances in our private subnet, no EIPs, route outgoing traffic via the NAT

In your LAMP application, you have some developers that say they would like access to your logs.However, since you are using an AWS Auto Scaling group, your instances are constantly being recreated. What would you do to make sure that these developers can access these log files? Choose the correct answer from the options below Please select:

Set up a central logging server that you can use to archive your logs; archive these logs to an S3 bucket for developer-access.

Give only the necessary access to the Apache servers so that the developers can gain access to the log files.

Give root access to your Apache servers to the developers.

Give read-only access to your developers to the Apache servers.

Set up a central logging server that you can use to archive your logs; archive these logs to an S3 bucket for developer-access.

Your company is planning on developing an application in AWS. This is a web based application. The application users will use their facebook or google identities for authentication. You want to have the ability to manage user profiles without having to add extra coding to manage this. Which of the below would assist in this.Please select:

Create an OlDC identity provider in AWS

Use AWS Cognito to manage the user profiles

Use IAM users to manage the user profiles

Your company is planning on developing an application in AWS. This is a web based application. The application user will use their facebook or google identities for authentication. You want to have the ability to manage user profiles without having to add extra coding to manage this. Which of the below would assist in this.Please select:

Use AWS Cognito to manage the user profiles

Create an OlDC identity provider in AWS

Use AWS Cognito to manage the user profiles

Use IAM users to manage the user profiles

Amazon SCS-C01 Practice Test 10 - Free Online Exam Prep & Questions

A large organization is planning on AWS to host their resources. They have a number of autonomous departments that wish to use AWS. What could be the strategy to adopt for managing the accounts. Please select:

Become a Premium Member for full access

Unlock Premium Member

Amazon SCS-C01 Practice Test 10

Question

Amazon SCS-C01 Practice Tests

Practice Tests