Quiz IT certification exam

Question 1

A developer signed in to a new account within an AWS Organization organizational unit (OU) containing multiple accounts. Access to the Amazon $3 service is restricted with the following SCP.

Amazon SCS-C01 image Question 481 7599 09162024005924000000

How can the security engineer provide the developer with Amazon $3 access without affecting other account?

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

Create a new OU without applying the SCP restricting $3 access. Move the developer account to this new OU.

Answer

Move the SCP to the root OU of organization to remove the restriction to access Amazon $3.

Answer

Add an IAM policy for the developer, which grants $3 access.

Answer

Add an allow list for the developer account for the $3 service.

Question 2

A company needs a security engineer to implement a scalable solution for multi-account authentication and authorization. The solution should not introduce additional user-managed architectural components. Native AWS features should be used as much as possible The security engineer has set up AWS Organizations w1th all features activated and AWS SSO enabled. Which additional steps should the security engineer take to complete the task?

Accepted Answer

Use an AW5 SSO default directory to create users and groups for all employees that require access to AWS accounts. Assign groups to AWS accounts and link to permission sets in accordance with the employees‘job functions and access requirements. Instruct employees to access AWS accounts by using the AWS SSO user portal.

Answer

Use AD Connector to create users and groups for all employees that require access to AWS accounts. Assign AD Connector groups to AWS accounts and link to the IAM roles in accordance with the employees‘job functions and access requirements Instruct employees to access AWS accounts by using the AWS Directory Service user portal.

Answer

Use an AWS SSO default directory to create users and groups for all employees that require access to AWS accounts. Link AWS SSO groups to the IAM users present in all accounts to inherit existing permissions. Instruct employees to access AWS accounts by using the AW5 SSO user portal.

Answer

Use AWS Directory Service tor Microsoft Active Directory to create users and groups for all employees that require access to AWS accounts Enable AWS Management Console access in the created directory and specify AWS SSO as a source cl information tor integrated accounts and permission sets. Instruct employees to access AWS accounts by using the AWS Directory Service user portal.

Question 3

A company deployed AWS Organizations to help manage its increasing number of AWS accounts. A security engineer wants to ensure only principals in the Organization structure can access a specific Amazon S3 bucket. The solution must also minimize operational overhead Which solution will meet these requirements?

Accepted Answer

Specify the organization ID in the global key condition element of a bucket policy, allowing all principals access.

Answer

1 Put all users into an IAM group with an access policy granting access to the J bucket.

Answer

Have the account creation trigger an AWS Lambda function that manages the bucket policy, allowing access to accounts listed in the policy only.

Answer

Add an SCP to the Organizations master account, allowing all principals access to the bucket.

Question 4

A company's engineering team is developing a new application that creates AWS Key Management Service (AWS KMS) CMK grants for users immediately after a grant IS created users must be able to use the CMK tu encrypt a 512-byte payload. During load testing, a bug appears |intermittently where AccessDeniedExceptions are occasionally triggered when a user first attempts to encrypt using the CMK Which solution should the c0mpany‘s security specialist recommend‘?

Accepted Answer

Instruct the engineering team to pass the grant token returned in the CreateGrant response to users. Instruct users to use that grant token in their call to encrypt.

Answer

Instruct users to implement a retry mechanism every 2 minutes until the call succeeds.

Answer

Instruct the engineering team to consume a random grant token from users, and to call the CreateGrant operation, passing it the grant token. Instruct use to use that grant token in their call to encrypt.

Answer

Instruct the engineering team to create a random name for the grant when calling the CreateGrant operation. Return the name to the users and instruct them to provide the name as the grant token in the call to encrypt.

Question 5

A website currently runs on Amazon EC2, wan mostly statics content on the site. Recently the site was subjected to a DDoS attack a security engineer was (asked was redesigning the edge security to help Mitigate this risk in the future. What are some ways the engineer could achieve this (Select THREE)?

Accepted Answer

Move the static content to Amazon S3, and front this with an Amazon Cloud Front distribution.

Accepted Answer

Use AWS WAF security rules to inspect the inbound traffic.

Accepted Answer

Use Amazon Route 53 to distribute traffic.

Answer

Use AWS X-Ray to inspect the traffic going to the EC2 instances.

Answer

Change the security group configuration to block the source of the attack traffic

Answer

Use Amazon Inspector assessment templates to inspect the inbound traffic.

Question 6

A company's on-premises networks are connected to VPCs using an AWS Direct Connect gateway.The company's on-premises application needs to stream data using an existing Amazon Kinesis Data Firehose delivery stream. The company's security policy requires that data be encrypted in transit using a private network. How should the company meet these requirements?

Accepted Answer

Create a VPC endpoint tor Kinesis Data Firehose. Configure the application to connect to the VPC endpoint.

Answer

Configure an 1AM policy to restrict access to Kinesis Data Firehose using a source IP condition. Configure the application to connect to the existing Firehose delivery stream.

Answer

Create a new TLS certificate in AWS Certificate Manager (ACM). Create a public-facing Network Load Balancer (NLB) and select the newly created TLS certificate. Configure the NLB to forward all traffic to Kinesis Data Firehose. Configure the application to connect to the NLB.

Answer

Peer the on-premises network with the Kinesis Data Firehose VPC using Direct Connect. Configure the application to connect to the existing Firehose delivery stream.

Question 7

A company has implemented AWS WAF and Amazon CloudFront for an application. The application runs on Amazon EC2 instances that are part of an Auto Scaling group. The Auto Scaling group is behind an Application Load Balancer (ALB).The AWS WAF web ACL uses an AWS Managed Rules rule group and is associated with the CloudFront distribution. CloudFront receives the request from AWS WAF and then uses the ALB as the distribution's origin. During a security review, a security engineer discovers that the infrastructure is susceptible to a large, layer 7 DDoS attack. How can the security engineer improve the security at the edge of the solution to defend against this type of attack?

Accepted Answer

Configure AWS WAF with a rate-based rule that imposes a rate limit that automatically blocks requests when the rate limit is exceeded.

Answer

Configure the CloudFront distribution to use the Lambda@Edge feature. Create an AWS Lambda function that imposes a rate limit on CloudFront viewer requests. Block the request if the rate limit is exceeded.

Answer

Configure the AWS WAF web ACL so that the web ACL has more capacity units to process all AWS WAF rules faster.

Answer

Configure the CloudFront distribution to use AWS WAF as its origin instead of the ALB.

Question 8

A security engineer needs to create an Amazon S3 bucket policy to grant least privilege read access to 1AM user accounts that are named User=1, User2. and User3. These IAM user accounts are members of the AuthorizedPeople IAM group. The security engineer drafts the following S3 bucket policy:<img alt="Amazon SCS-C01 image Question 488 7606 09162024005924000000"   width="810" height="398" src="https://examgecko.com/getfile/6cd4318f-cfa2-48f7-bf3c-98334b3511d3">When the security engineer tries to add the policy to the S3 bucket, the following error message appears: "Missing required field Principal." The security engineer is adding a Principal element to the policy. The addition must provide read access to only User1. User2, and User3. Which solution meets these requirements?

Accepted Answer

Question 9

A company is building an application on AWS that will store sensitive Information. The company has a support team with access to the IT infrastructure, including databases. The company's security engineer must introduce measures to protect the sensitive data against any data breach while minimizing management overhead. The credentials must be regularly rotated. What should the security engineer recommend?

Accepted Answer

Enable Amazon RDS encryption to encrypt the database and snapshots. Enable Amazon Elastic Block Store (Amazon EBS) encryption on Amazon EC2 instances. Store the database credentials in AWS Secrets Manager with automatic rotation. Set up TLS for the connection to the RDS hosted database.

Answer

Enable Amazon RDS encryption to encrypt the database and snapshots. Enable Amazon Elastic Block Store (Amazon EBS) encryption on Amazon EC2 instances. Include the database credential in the EC2 user data field. Use an AWS Lambda function to rotate database credentials. Set up TLS for the connection to the database.

Answer

Install a database on an Amazon EC2 Instance. Enable third-party disk encryption to encrypt the Amazon Elastic Block Store (Amazon EBS) volume. Store the database credentials in AWS CloudHSM with automatic rotation. Set up TLS for the connection to the database.

Answer

Set up an AWS CloudHSM cluster with AWS Key Management Service (AWS KMS) to store KMS keys. Set up Amazon RDS encryption using AWS KMS to encrypt the database. Store database credentials in the AWS Systems Manager Parameter Store with automatic rotation. Set up TLS for the connection to the RDS hosted database.

Question 10

A company deployed Amazon GuardDuty In the us-east-1 Region. The company wants all DNS logs that relate to the company's Amazon EC2 instances to be inspected. What should a security engineer do to ensure that the EC2 instances are logged?

Accepted Answer

Use AWS DNS resolvers for all EC2 instances.

Answer

Use IPv6 addresses that are configured for hostnames.

Answer

Configure external DNS resolvers as internal resolvers that are visible only to AWS.

Answer

Configure a third-party DNS resolver with logging for all EC2 instances.

Question 11

A company wants to establish separate AWS Key Management Service (AWS KMS) keys to use for different AWS services. The company's security engineer created the following key policy lo allow the infrastructure deployment team to create encrypted Amazon Elastic Block Store (Amazon EBS) volumes by assuming the InfrastructureDeployment 1AM role:<img alt="Amazon SCS-C01 image Question 491 7609 09162024005924000000"   width="992" height="754" src="https://examgecko.com/getfile/13a72c61-0c2f-44aa-a6c9-53b0b1417c1c">The security engineer recently discovered that 1AM roles other than the InfrastructureDeployment role used this key (or other services. Which change to the policy should the security engineer make to resolve these issues?

Accepted Answer

In the statement block that contains the Sid "Allow use of the Key", under the "Condition" block, change the Kms:ViaService value to ec2.us-east-1 .amazonaws com.

Answer

In the statement block that contains the Sid "Allow use of the key", under the "Condition" block, change StringEquals to StringLike.

Answer

In the policy document, remove the statement Dlock that contains the Sid "Enable 1AM User Permissions". Add key management policies to the KMS policy.

Answer

In the policy document, add a new statement block that grants the kms:Disable' permission to the security engineer's IAM role.

Question 12

A company stores images for a website in an Amazon S3 bucket. The company is using Amazon CloudFront to serve the images to end users. The company recently discovered that the images are being accessed from countries where the company does not have a distribution license.Which actions should the company take to secure the images to limit their distribution? (Select TWO.)

Accepted Answer

Update the S3 bucket policy to restrict access to a CloudFront origin access identity (OAI).

Accepted Answer

Add a CloudFront geo restriction deny list of countries where the company lacks a license.

Answer

Update the website DNS record to use an Amazon Route 53 geolocation record deny list of countries where the company lacks a license.

Answer

Update the S3 bucket policy with a deny list of countries where the company lacks a license.

Answer

Enable the Restrict Viewer Access option in CloudFront to create a deny list of countries where the company lacks a license.

Question 13

A company maintains an open-source application that is hosted on a public GitHub repository. While creating a new commit to the repository, an engineer uploaded their AWS access key and secret access key. The engineer reported the mistake to a manager, and the manager immediately disabled the access key.The company needs to assess the impact of the exposed access key. A security engineer must recommend a solution that requires the least possible managerial overhead. Which solution meets these requirements?

Accepted Answer

Analyze an AWS Identity and Access Management (1AM) use report from AWS Trusted Advisor to see when the access key was last used.

Answer

Analyze Amazon CloudWatch Logs for activity by searching for the access key.

Answer

Analyze VPC flow logs for activity by searching for the access key

Answer

Analyze a credential report in AWS Identity and Access Management (1AM) to see when the access key was last used.

Question 14

A developer at a company uses an SSH key to access multiple Amazon EC2 instances. The company discovers that the SSH key has been posted on a public GitHub repository. A security engineer verifies that the key has not been used recently.How should the security engineer prevent unauthorized access to the EC2 instances?

Accepted Answer

Restrict SSH access in the security group to only known corporate IP addresses.

Answer

Delete the key pair from the EC2 console. Create a new key pair.

Answer

Use the ModifylnstanceAttribute API operation to change the key on any EC2 instance that is using the key.

Answer

Update the key pair in any AMI that is used to launch the EC2 instances. Restart the EC2 instances.

Question 15

A company uses an external identity provider to allow federation into different AWS accounts. A security engineer for the company needs to identify the federated user that terminated a production Amazon EC2 instance a week ago. What is the FASTEST way for the security engineer to identify the federated user?

Accepted Answer

Filter the AWS CloudTrail event history for the Terminatelnstances event and identify the assumed 1AM role. Review the AssumeRoleWithSAML event call in CloudTrail to identify the corresponding username.

Answer

Review the AWS CloudTrail event history logs in an Amazon S3 bucket and look for the Terminatelnstances event to identify the federated user from the role session name.

Answer

Search the AWS CloudTrail logs for the Terminatelnstances event and note the event time. Review the 1AM Access Advisor tab for all federated roles. The last accessed time should match the time when the instance was terminated.

Answer

Use Amazon Athena to run a SQL query on the AWS CloudTrail logs stored in an Amazon S3 bucket and filter on the Terminatelnstances event. Identify the corresponding role and run another query to filter the AssumeRoleWithWebldentity event for the user name.

Question 16

An audit determined that a company's Amazon EC2 instance security group violated company policy by allowing unrestricted incoming SSH traffic. A security engineer must implement a near-real-time monitoring and alerting solution that will notify administrators of such violations.Which solution meets these requirements with the MOST operational efficiency?

Accepted Answer

Create a recurring Amazon Inspector assessment run that runs every day and uses the Network Reachability package. Create an Amazon CloudWatch rule that invokes an AWS Lambda function when an assessment run starts. Configure the Lambda function to retrieve and evaluate the assessment run report when it completes. Configure the Lambda function also to publish an Amazon Simple Notification Service (Amazon SNS) notification if there are any violations for unrestricted incoming SSH traffic.

Answer

Use the restricted-ssh AWS Config managed rule that is invoked by security group configuration changes that are not compliant. Use the AWS Config remediation feature to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic.

Answer

Configure VPC Flow Logs for the VPC. and specify an Amazon CloudWatch Logs group. Subscribe the CloudWatch Logs group to an AWS Lambda function that parses new log entries, detects successful connections on port 22, and publishes a notification through Amazon Simple Notification Service (Amazon SNS).

Answer

Create a recurring Amazon Inspector assessment run that runs every day and uses the Security Best Practices package. Create an Amazon CloudWatch rule that invokes an AWS Lambda function when an assessment run starts. Configure the Lambda function to retrieve and evaluate the assessment run report when it completes. Configure the Lambda function also to publish an Amazon Simple Notification Service (Amazon SNS) notification if there are any violations for unrestricted incoming SSH traffic.

Question 17

A company manages multiple AWS accounts using AWS Organizations. The company's security team notices that some member accounts are not sending AWS CloudTrail logs to a centralized Amazon S3 logging bucket. The security team wants to ensure there is at least one trail configured (or all existing accounts and for any account that is created in the future. Which set of actions should the security team implement to accomplish this?

Accepted Answer

Edit the existing trail in the Organizations master account and apply it to the organization.

Answer

Create a new trail and configure it to send CloudTrail logs to Amazon S3. Use Amazon EventBridge (Amazon CloudWatch Events) to send notification if a trail is deleted or stopped.

Answer

Deploy an AWS Lambda function in every account to check if there is an existing trail and create a new trail, if needed.

Answer

Create an SCP to deny the cloudtrail:Delete" and cloudtrail:Stop' actions. Apply the SCP to all accounts.

Question 18

A company's cloud operations team is responsible for building effective security for AWS crossaccount access. The team asks a security engineer to help troubleshoot why some developers in the developer account (123456789012) in the developers group are not able to assume a cross-account role (ReadS3) into a production account (999999999999) to read the contents of an Amazon S3 bucket (productionapp). The two account policies are as follows:<img alt="Amazon SCS-C01 image Question 498 7616 09162024005924000000"   width="791" height="1269" src="https://examgecko.com/getfile/a8009271-a3c6-4388-90f9-a6984f45948c">Which recommendations should the security engineer make to resolve this issue? (Select TWO.)

Accepted Answer

Ask the developers to change their password and use a different web browser.

Accepted Answer

Update the trust relationship policy on the production account S3 role to allow the account number of the developer account.

Answer

Ensure that developers are using multi-factor authentication (MFA) when they log in to their developer account as the developer role.

Answer

Modify the production account ReadS3 role policy to allow the PutBucketPolicy action on the productionapp S3 bucket.

Answer

Update the developer group permissions in the developer account to allow access to the productionapp S3 bucket.

Question 19

A company is using AWS Organizations to develop a multi-account secure networking strategy. The company plans to use separate centrally managed accounts for shared services, auditing, and security inspection. The company plans to provide dozens of additional accounts to application owners for production and development environments. Company security policy requires that all internet traffic be routed through a centrally managed security inspection layer in the security inspection account. A security engineer must recommend a solution that minimizes administrative overhead and complexity.Which solution meets these requirements?

Accepted Answer

Use AWS Control Tower. Modify the default Account Factory networking template to automatically associate new accounts with a centrally managed transit gateway and to create a default route to the transit gateway in the default route table. Create an SCP that denies the AttachlnternetGateway action. Attach the SCP to all accounts except the security inspection account.

Answer

Use AWS Control Tower. Modify the default Account Factory networking template to automatically associate new accounts with a centrally managed VPC through a VPC peering connection and to create a default route to the VPC peer in the default route table. Create an SCP that denies the CreatelnternetGateway action. Attach the SCP to all accounts except the security inspection account.

Answer

Create a centrally managed VPC in the security inspection account. Establish VPC peering connections between the security inspection account and other accounts. Instruct account owners to create default routes in their account route tables that point to the VPC peer. Create an SCP that denies the Attach InternetGateway action. Attach the SCP to all accounts except the security inspection account.

Answer

Enable AWS Resource Access Manager (AWS RAM) for AWS Organizations. Create a shared transit gateway, and make it available by using an AWS RAM resource share. Create an SCP that denies the CreatelnternetGateway action. Attach the SCP to all accounts except the security inspection account.Create routes in the route tables of all accounts that point to the shared transit gateway.

Question 20

A company plans to create individual child accounts within an existing organization in AWS Organizations for each of its DevOps teams. AWS CloudTrail has been enabled and configured on all accounts to write audit logs to an Amazon S3 bucket in a centralized AWS account. A security engineer needs to ensure that DevOps team members are unable to modify or disable this configuration. How can the security engineer meet these requirements?

Accepted Answer

Create an 1AM policy that prohibits changes to the specific CloudTrail trail and apply the policy to a new 1AM group. Have team members use individual 1AM accounts that are members of the new 1AM group.

Answer

Create an 1AM policy that prohibits changes to the specific CloudTrail trail and apply the policy to the AWS account root user.

Answer

Create an S3 bucket policy in the specified destination account for the CloudTrail trail that prohibits configuration changes from the AWS account root user in the source account.

Answer

Create an SCP that prohibits changes to the specific CloudTrail trail and apply the SCP to the appropriate organizational unit or account in Organizations.

Question 21

A company uses Amazon RDS for MySQL as a database engine for its applications. A recent security audit revealed an RDS instance that is not compliant with company policy for encrypting data at rest. A security engineer at the company needs to ensure that all existing RDS databases are encrypted using server-side encryption and that any future deviations from the policy are detected. Which combination of steps should the security engineer take to accomplish this? (Select TWO.)

Accepted Answer

Create an AWS Config rule to detect the creation of unencrypted RDS databases. Create an Amazon EventBridge (Amazon CloudWatch Events) rule to trigger on the AWS Config rules compliance state change and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.

Accepted Answer

Take a snapshot of the unencrypted RDS database. Copy the snapshot and enable snapshot encryption in the process. Restore the database instance from the newly created encrypted snapshot. Terminate the unencrypted database instance.

Answer

Use AWS System Manager State Manager to detect RDS database encryption configuration drift.Create an Amazon EventBridge (Amazon CloudWatch Events) rule to track state changes and use Amazon Simple Notification Service (Amazon SNS) to notify the security operations team.

Answer

Create a read replica for the existing unencrypted RDS database and enable replica encryption in the process. Once the replica becomes active, promote it into a standalone database instance and terminate the unencrypted database instance.

Answer

Enable encryption for the identified unencrypted RDS instance by changing the configurations of the existing database

Question 22

A company is running an application in The eu-west-1 Region. The application uses an AWS Key Management Service (AWS KMS) CMK to encrypt sensitive dat a. The company plans to deploy the application in the eu-north-1 Region. A security engineer needs to implement a key management solution for the application deployment in the new Region. The security engineer must minimize changes to the application code. Which change should the security engineer make to the AWS KMS configuration to meet these requirements?

Accepted Answer

Allocate a new CMK to eu-north-1 to be used by the application that is deployed in that Region.

Answer

Update the key policies in eu-west-1. Point the application in eu-north-1 to use the same CMK as the application in eu-west-1.

Answer

Allocate a new CMK to eu-north-1. Create the same alias name for both keys. Configure the application deployment to use the key alias.

Answer

Allocate a new CMK to eu-north-1. Create an alias for eu-'-1. Change the application code to point to the alias for eu-'-1.

Question 23

A development team is using an AWS Key Management Service (AWS KMS) CMK to try to encrypt and decrypt a secure string parameter from AWS Systems Manager Parameter Store. However, the development team receives an error message on each attempt.Which issues that are related to the CMK could be reasons for the error? (Select TWO.)

Accepted Answer

The CMK that is used in the attempt does not exist.

Accepted Answer

The CMK that is used in the attempt is not enabled.

Answer

The CMK that is used in the attempt needs to be rotated.

Answer

The CMK that is used in the attempt is using the CMK's key ID instead of the CMK ARN.

Answer

The CMK that is used in the attempt is using an alias.

Question 24

A company wants to ensure that its AWS resources can be launched only in the us-east-1 and uswest- 2 Regions. What is the MOST operationally efficient solution that will prevent developers from launching Amazon EC2 instances in other Regions?

Accepted Answer

Provision EC2 resources by using AWS Cloud Formation templates through AWS CodePipeline.Allow only the values of us-east-1 and us-west-2 in the AWS CloudFormation template's parameters.

Answer

Enable Amazon GuardDuty in all Regions. Create alerts to detect unauthorized activity outside useast- 1 and us-west-2.

Answer

Use an organization in AWS Organizations. Attach an SCP that allows all actions when the aws:Requested Region condition key is either us-east-1 or us-west-2. Delete the FullAWSAccess policy.

Answer

Create an AWS Config rule to prevent unauthorized activity outside us-east-1 and us-west-2.

Question 25

A company is implementing a new application in a new AWS account. A VPC and subnets have been created for the application. The application has been peered to an existing VPC in another account in the same AWS Region for database access. Amazon EC2 instances will regularly be created and terminated in the application VPC, but only some of them will need access to the databases in the peered VPC over TCP port 1521. A security engineer must ensure that only the EC2 instances that need access to the databases can access them through the network.How can the security engineer implement this solution?

Accepted Answer

Create a new security group in the application VPC with no inbound rules. Create a new security group in the database VPC with an inbound rule that allows TCP port 1521 from the new application security group in the application VPC. Attach the application security group to the application instances that need database access, and attach the database security group to the database instances.

Answer

Create a new security group in the database VPC and create an inbound rule that allows all traffic from the IP address range of the application VPC. Add a new network ACL rule on the database subnets. Configure the rule to TCP port 1521 from the IP address range of the application VPC. Attach the new security group to the database instances that the application instances need to access.

Answer

Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Create a new security group in the database VPC with an inbound rule that allows the IP address range of the application VPC over port 1521. Attach the new security group to the database instances and the application instances that need database access.

Answer

Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Add a new network ACL rule on the database subnets. Configure the rule to allow all traffic from the IP address range of the application VPC.Attach the new security group to the application instances that need database access.

Question 26

A company stores sensitive documents in Amazon S3 by using server-side encryption with an AWS Key Management Service (AWS KMS) CMK. A new requirement mandates that the CMK that is used for these documents can be used only for S3 actions.Which statement should the company add to the key policy to meet this requirement?

Accepted Answer

Question 27

A security engineer is defining the controls required to protect the AWS account root user credentials in an AWS Organizations hierarchy. The controls should also limit the impact in case these credentials have been compromised. Which combination of controls should the security engineer propose? (Select THREE.)

Accepted Answer

Accepted Answer

Enable multi-factor authentication (MFA) for the root user.

Accepted Answer

Create an access key ID and secret access key, and store them in a secure location.

Answer

Set a strong randomized password and store it in a secure location.

Answer

Apply the following permissions boundary to the toot user:

Question 28

A company is using AWS Organizations. The company wants to restrict AWS usage to the eu-west-1 Region for all accounts under an OU that is named "development." The solution must persist restrictions to existing and new AWS accounts under the development OU. Amazon SCS-C01 image Question 508 7626 09162024005924000000

Amazon SCS-C01 image Question 508 7626 09162024005924000000

Accepted Answer

Option A

Answer

Option B

Answer

Option C

Answer

Option D

Question 29

A company is undergoing a layer 3 and layer 4 DDoS attack on its web servers running on AWS.Which combination of AWS services and features will provide protection in this scenario? (Select THREE).

Accepted Answer

AWS Shield

Accepted Answer

Elastic Load Balancer

Accepted Answer

Amazon GuardDuty

Answer

Amazon Route 53

Answer

AWS Certificate Manager (ACM)

Answer

Amazon S3

Question 30

A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off. What is the MOST efficient way to implement this solution?

Accepted Answer

Create an Amazon EventBridge (Amazon CloudWatch Events) event with a cloudtrail.amazonaws.com event source and a StartLogging event name to trigger an AWS Lambda function to call the StartLogging API.

Answer

Use AWS Config with a managed rule to trigger the AWS-EnableCloudTrail remediation.

Answer

Create an Amazon CloudWatch alarm with a cloudtrail.amazonaws.com event source and a StopLogging event name to trigger an AWS Lambda function to call the StartLogging API.

Answer

Monitor AWS Trusted Advisor to ensure CloudTrail logging is enabled.

Question 31

A company hosts an application on Amazon EC2 that is subject to specific rules for regulatory compliance. One rule states that traffic to and from the workload must be inspected for networklevel attacks. This involves inspecting the whole packet.To comply with this regulatory rule, a security engineer must install intrusion detection software on a c5n.4xlarge EC2 instance. The engineer must then configure the software to monitor traffic to and from the application instances. What should the security engineer do next?

Accepted Answer

Use Amazon Inspector to detect network-level attacks and trigger an AWS Lambda function to send the suspicious packets to the EC2 instance.

Answer

Place the network interface in promiscuous mode to capture the traffic.

Answer

Configure VPC Flow Logs to send traffic to the monitoring EC2 instance using a Network Load Balancer.

Answer

Configure VPC traffic mirroring to send traffic to the monitoring EC2 instance using a Network Load Balancer.

Question 32

A company deploys a set of standard IAM roles in AWS accounts. The IAM roles are based on job functions within the company. To balance operational efficiency and security, a security engineer implemented AWS Organizations SCPs to restrict access to critical security services in all company accounts.All of the company's accounts and OUs within AWS Organizations have a default FullAWSAccess SCP that is attached. The security engineer needs to ensure that no one can disable Amazon GuardDuty and AWS Security Hub. The security engineer also must not override other permissions that are granted by 1AM policies that are defined in the accounts. Which SCP should the security engineer attach to the root of the organization to meet these requirements?<img alt="Amazon SCS-C01 image Question 512 7630 09162024005924000000"   width="873" height="610" src="https://examgecko.com/getfile/16839d99-f906-48df-b57f-4cceb625c029">

Accepted Answer

Question 33

A company has developed a new Amazon RDS database application. The company must secure the ROS database credentials for encryption in transit and encryption at rest. The company also must rotate the credentials automatically on a regular basis.Which solution meets these requirements?

Accepted Answer

Use AWS Systems Manager Parameter Store to store the database credentiais. Configure automatic rotation of the credentials.

Answer

Use AWS Secrets Manager to store the database credentials. Configure automat* rotation of the credentials

Answer

Store the database credentials in an Amazon S3 bucket that is configured with server-side encryption with S3 managed encryption keys (SSE-S3) Rotate the credentials with 1AM database authentication.

Answer

Store the database credentials m Amazon S3 Glacier, and use S3 Glacier Vault Lock Configure an AWS Lambda function to rotate the credentials on a scheduled basts

Question 34

A company deploys a distributed web application on a fleet of Amazon EC2 instances. The fleet is behind an Application Load Balancer (ALB) that will be configured to terminate the TLS connection. All TLS traffic to the ALB must stay secure, even if the certificate private key is compromised.How can a security engineer meet this requirement?

Accepted Answer

Create an HTTPS listener that uses a certificate that is managed by AWS Certificate Manager (ACM).

Answer

Create an HTTPS listener that uses a security policy that uses a cipher suite with perfect towardsecrecy (PFS).

Answer

Create an HTTPS listener that uses the Server Order Preference security feature.

Answer

Create a TCP listener that uses a custom security policy that allows only cipher suites with perfect forward secrecy (PFS).

Question 35

A company's application team wants to replace an internal application with a new AWS architecture that consists of Amazon EC2 instances, an AWS Lambda function, and an Amazon S3 bucket in a single AWS Region. After an architecture review, the security team mandates that no application network traffic can traverse the public internet at any point. The security team already has an SCP in place for the company's organization in AWS Organizations to restrict the creation of internet gateways. NAT gateways, and egress-only gateways.Which combination of steps should the application team take to meet these requirements? (Select THREE.)

Accepted Answer

Create an S3 endpoint that has a full-access policy for the application's VPC.

Accepted Answer

Create a security group that has an outbound rule over port 443 with a destination of the S3 endpomt. Associate the security group with the EC2 instances.

Accepted Answer

Launch the Lambda function in a VPC.

Answer

Create an S3 access point for the S3 bucket. Include a policy that restricts the network origin to VPCs.

Answer

Launch the Lambda function. Enable the block public access configuration.

Answer

Create a security group that has an outbound rule over port 443 with a destination of the S3 access point. Associate the security group with the EC2 instances.

Question 36

A security engineer receives an AWS abuse email message. According to the message, an Amazon EC2 instance that is running in the security engineer's AWS account is sending phishing email messages. The EC2 instance is part of an application that is deployed in production. The application runs on many EC2 instances behind an Application Load Balancer. The instances run in an Amazon EC2 Auto Scaling group across multiple subnets and multiple Availability Zones.The instances normally communicate only over the HTTP. HTTPS, and MySQL protocols. Uponinvestigation, the security engineer discovers that email messages are being sent over port 587. Allother traffic is normal. The security engineer must create a solution that contains the compromised EC2 instance, preserves forensic evidence for analysis, and minimizes application downtime. Which combination of steps must the security engineer take to meet these requirements? (Select THREE.)

Accepted Answer

Add an outbound rule to the security group that is attached to the compromised EC2 instance to deny traffic to 0.0.0.0/0 and port 587.

Accepted Answer

Gather volatile memory from the compromised EC2 instance. Suspend the compromised EC2 instance from the Auto Scaling group. Then take a snapshot of the compromised EC2 instance. v

Accepted Answer

Move the compromised EC2 instance to an isolated subnet that has a network ACL that has no inbound rules or outbound rules.

Answer

Add an outbound rule to the network ACL for the subnet that contains the compromised EC2 instance to deny traffic to 0.0.0.0/0 and port 587.

Answer

Take a snapshot of the compromised EC2 instance. Suspend the compromised EC2 instance from the Auto Scaling group. Then gather volatile memory from the compromised EC2 instance.

Answer

Replace the existing security group that is attached to the compromised EC2 instance with a new security group that has no inbound rules or outbound rules.

Question 37

A company has an application that uses an Amazon RDS PostgreSQL database. The company is developing an application feature that will store sensitive information for an individual in the database. During a security review of the environment, the company discovers that the RDS DB instance is not encrypting data at rest. The company needs a solution that will provide encryption at rest for all the existing data and for any new data that is entered for an individual.Which combination of options can the company use to meet these requirements? (Select TWO.)

Accepted Answer

Use AWS Key Management Service (AWS KMS) to create a new default AWS managed awa/rds key. Select this key as the encryption key for operations with Amazon RDS.

Accepted Answer

Create a snapshot of the DB instance. Enable encryption on the snapshoVUse the snapshot to restore the DB instance.

Answer

Create a snapshot of the DB instance. Copy the snapshot to a new snapshot, and enable encryption for the copy process. Use the new snapshot to restore the DB instance.

Answer

Modify the configuration of the DB instance by enabling encryption. Create a snapshot of the DB instance. Use the snapshot to restore the DB instance.

Answer

Use AWS Key Management Service (AWS KMS] to create a new CMK. Select this key as the encryption key for operations with Amazon RDS.

Question 38

A company is hosting multiple applications within a single VPC in its AWS account. The applications are running behind an Application Load Balancer that is associated with an AWS WAF web ACL. The company's security team has identified that multiple port scans are originating from a specific range of IP addresses on the internet. A security engineer needs to deny access from the offending IP addresses.Which solution will meet these requirements?

Accepted Answer

Modify the AWS WAF web ACL with an IP set match rule statement to deny incoming requests from the IP address range.

Answer

Add a rule to all security groups to deny the incoming requests from the IP address range.

Answer

Modify the AWS WAF web ACL with a rate-based rule statement to deny the incoming requests from the IP address range.

Answer

Configure the AWS WAF web ACL with regex match conditions. Specify a pattern set to deny the incoming requests based on the match condition

Question 39

A company's application team needs to host a MySQL database on AWS. According to the company's security policy, all data that is stored on AWS must be encrypted at rest. In addition, all cryptographic material must be compliant with FIPS 140-2 Level 3 validation.The application team needs a solution that satisfies the company's security requirements and minimizes operational overhead. Which solution will meet these requirements?

Accepted Answer

Host the database on Amazon RDS. Use Amazon Elastic Block Store (Amazon EBS) for encryption.Use an AWS managed CMK in AWS Key Management Service (AWS KMS) for key management.

Answer

Host the database on Amazon RDS. Use Amazon Elastic Block Store (Amazon EBS) for encryption.Use an AWS Key Management Service (AWS KMS) custom key store that is backed by AWS CloudHSM for key management.

Answer

Host the database on an Amazon EC2 instance. Use Amazon Elastic Block Store (Amazon EBS) for encryption. Use a customer managed CMK in AWS Key Management Service (AWS KMS) for key management.

Answer

Host the database on an Amazon EC2 instance. Use Transparent Data Encryption (TDE) for encryption and key management.

Question 40

A Network Load Balancer (NLB) target instance is not entering the InService state. A security engineer determines that health checks are failing. Which factors could cause the health check failures? (Select THREE.)

Accepted Answer

The target instance's security group does not allow traffic from the NLB.

Accepted Answer

The NLB's security group is not attached to the target instance.

Accepted Answer

The target instance's subnet network ACL does not allow traffic from the NLB.

Answer

The target instance's security group is not attached to the NLB.

Answer

The target instance's security group is not using IP addresses to allow traffic from the NLB.

Answer

The target network ACL is not attached to the NLB.

Amazon SCS-C01 Practice Test 13

Amazon SCS-C01 Practice Tests