Quiz IT certification exam

Question 1

A company has recently recovered from a security incident that required the restoration of Amazon EC2 instances from snapshots. After performing a gap analysis of its disaster recovery procedures and backup strategies, the company is concerned that, next time, it will not be able to recover the EC2 instances if the AWS account was compromised and Amazon EBS snapshots were deleted.

All EBS snapshots are encrypted using an AWS KMS CMK.

Which solution would solve this problem?

Accepted Answer

Create a new Amazon S3 bucket Use EBS lifecycle policies to move EBS snapshots to the new S3 bucket. Move snapshots to Amazon S3 Glacier using lifecycle policies, and apply Glacier Vault Lock policies to prevent deletion

Answer

Use AWS Systems Manager to distribute a configuration that performs local backups of all attached disks to Amazon S3.

Answer

Create a new AWS account with limited privileges. Allow the new account to access the AWS KMS key used to encrypt the EBS snapshots, and copy the encrypted snapshots to the new account on a recuning basis

Answer

Use AWS Backup to copy EBS snapshots to Amazon S3.

Question 2

A security engineer needs to configure monitoring and auditing for AWS Lambda.Which combination of actions using AWS services should the security engineer take to accomplish this goal? (Select TWO.)

Accepted Answer

Use AWS Config to track configuration changes to Lambda functions, runtime environments, tags, handler names, code sizes, memory allocation, timeout settings, and concurrency settings, along with Lambda IAM execution role, subnet, and security group associations.

Accepted Answer

Use AWS CloudTrail to implement governance, compliance, operational, and risk auditing for Lambda.

Answer

Use Amazon Inspector to automatically monitor for vulnerabilities and perform governance, compliance, operational, and risk auditing for Lambda.

Answer

Use AWS Resource Access Manager to track configuration changes to Lambda functions, runtime environments, tags, handler names, code sizes, memory allocation, timeout settings, and concurrency settings, along with Lambda IAM execution role, subnet, and security group associations.

Answer

Use Amazon Macie to discover, classify, and protect sensitive data being executed inside the Lambda function.

Question 3

A company is setting up products to deploy in AWS Service Catalog. Management is concerned that when users launch products, elevated IAM privileges will be required to create resources. How should the company mitigate this concern?

Accepted Answer

Add a launch constraint to each product in the portfolio.

Answer

Add a template constraint to each product in the portfolio.

Answer

Define resource update constraints for each product in the portfolio.

Answer

Update the AWS CloudFormalion template backing the product to include a service role configuration.

Question 4

A Security Engineer has been asked to troubleshoot inbound connectivity to a web server. This single web server is not receiving inbound connections from the internet, whereas all other web servers are functioning properly. The architecture includes network ACLs, security groups, and a virtual security appliance. In addition, the Development team has implemented Application Load Balancers (ALBs) to distribute the load across all web servers. It is a requirement that traffic between the web servers and the internet flow through the virtual security appliance. The Security Engineer has verified the following:

Accepted Answer

The rule set in the virtual appliance is correctWhich of the following are other valid items to troubleshoot in this scenario? (Choose two.)

Accepted Answer

Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to a NAT gateway.

Answer

The rule set in the Security Groups is correct

Answer

The rule set in the network ACLs is correct

Answer

Verify which Security Group is applied to the particular web server’s elastic network interface (ENI).

Answer

Verify that the 0.0.0.0/0 route in the route table for the web server subnet points to the virtual security appliance.

Answer

Verify the registered targets in the ALB.

Answer

Verify that the 0.0.0.0/0 route in the public subnet points to a NAT gateway.

Question 5

A company has a VPC with an IPv6 address range and a public subnet with an IPv6 address block. The VPC currently hosts some public Amazon EC2 instances but a Security Engineer needs to migrate a second application into the VPC that also requires IPv6 connectivity.This new application will occasionally make API requests to an external, internet-accessible endpoint to receive updates However, the Security team does not want the application's EC2 instance exposed directly to the internet The Security Engineer intends to create a private subnet with a custom route table and to associate the route table with the private subnet What else does the Security Engineer need to do to ensure the application will not be exposed directly to the internet, but can still communicate as required''

Accepted Answer

Add an egress-only internet gateway to the VPC. Update the custom route table with a new route to the gateway

Answer

Launch a NAT instance in the public subnet Update the custom route table with a new route to the NAT instance

Answer

Remove the internet gateway, and add AWS PrivateLink to the VPC Then update the custom route table with a new route to AWS PrivateLink

Answer

Add a managed NAT gateway to the VPC Update the custom route table with a new route to the gateway

Question 6

Which of the following are valid configurations for using SSL certificates with Amazon CloudFront?(Select THREE )

Accepted Answer

Default AWS Certificate Manager certificate

Accepted Answer

Default CloudFront certificate

Accepted Answer

Custom SSL certificate stored in AWS Certificate Manager

Answer

Custom SSL certificate stored in AWS KMS

Answer

Default SSL certificate stored in AWS Secrets Manager

Answer

Custom SSL certificate stored in AWS IAM

Question 7

A company has implemented centralized logging and monitoring of AWS CloudTrail logs from all Regions in an Amazon S3 bucket. The log Hies are encrypted using AWS KMS. A Security Engineer is attempting to review the log files using a third-party tool hosted on an Amazon EC2 instance The Security Engineer is unable to access the logs in the S3 bucket and receives an access denied error message What should the Security Engineer do to fix this issue?

Accepted Answer

Check that the role the EC2 instance profile uses grants permission lo decrypt objects using the KMS CMK and gives access to the S3 bucket and objects

Answer

Check that the role the Security Engineer uses grants permission to decrypt objects using the KMS CMK.

Answer

Check that the role the Security Engineer uses grants permission to decrypt objects using the KMS CMK and gives access to the S3 bucket and objects

Answer

Check that the role the EC2 instance profile uses grants permission to decrypt objects using the KMS CMK

Question 8

Users report intermittent availability of a web application hosted on AWS. Monitoring systems report an excess of abnormal network traffic followed by high CPU utilization on the application web tier. Which of the following techniques will improve the availability of the application? (Select TWO.)

Accepted Answer

Deploy an Intrusion Detection/Prevention System (IDS/IPS) to monitor or block unusual incoming network traffic.

Accepted Answer

Create Amazon CloudFront distribution and configure AWS WAF rules to protect the web applications from malicious traffic.

Answer

Deploy AWS WAF to block all unsecured web applications from accessing the internet.

Answer

Configure security groups to allow outgoing network traffic only from hosts that are protected with up-to-date antivirus software.

Answer

Use the default Amazon VPC for externakfacing systems to allow AWS to actively block malicious network traffic affecting Amazon EC2 instances.

Question 9

A company uses SAML federation with AWS Identity and Access Management (IAM) to provide internal users with SSO for their AWS accounts. The company's identity provider certificate was rotated as part of its normal lifecycle. Shortly after, users started receiving the following error when attempting to log in:"Error: Response Signature Invalid (Service: AWSSecuntyTokenService; Status Code: 400; Error Code: InvalidldentltyToken)" A security engineer needs to address the immediate issue and ensure that it will not occur again. Which combination of steps should the security engineer take to accomplish this? (Select TWO.)

Accepted Answer

Download a new copy of the SAML metadata file from the identity provider Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity.

Accepted Answer

During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new copy of the metadata file and create a new IAM identity provider entity. Upload the metadata file to the new IAM identity provider entity. Perform automated or manual rotation of the certificate when required.

Answer

During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required.

Answer

Download a new copy of the SAML metadata file from the identity provider Upload the new metadata to the IAM identity provider entity configured for the SAML integration in question.

Answer

Download a new copy of the SAML metadata file from the identity provider Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity. Update the identity provider configurations to pass a new IAM identity provider entity name in the SAML assertion.

Question 10

A company Is building a data lake on Amazon S3. The data consists of millions of small files containing sensitive information. The security team has the following requirements for the architecture:• Data must be encrypted in transit.• Data must be encrypted at rest.• The bucket must be private, but if the bucket is accidentally made public, the data must remain confidential. Which combination of steps would meet the requirements? (Select THREE.)

Accepted Answer

Enable default encryption with server-side encryption with AWS KMS-managed keys (SSE-KMS) on the S3 bucket.

Accepted Answer

Add a bucket policy with ws: Sourcelpto Allow uploads and downloads from the corporate intranet only.

Accepted Answer

Enable Amazon Macie to monitor and act on changes to the data lake's S3 bucket.

Answer

Enable AES-256 encryption using server-side encryption with Amazon S3-managed encryption keys (SSE-S3) on the S3 bucket

Answer

Add a bucket policy that includes a deny if a PutObject request does not include awsiSecureTcanspoct.

Answer

Add a bucket policy that includes a deny if a PutObject request does not include s3:x-amz-sairv9rside- enctyption: "aws: kms".

Question 11

A company's on-premises data center forwards DNS logs to a third-party security incident events management (SIEM) solution that alerts on suspicious behavior. The company wants to introduce a similar capability to its AWS accounts that includes automatic remediation. The company expects to double in size within the next few months.Which solution meets the company's current and future logging requirements?

Accepted Answer

Enable Amazon GuardDuty and AWS Security Hub in all Regions and all accounts. Designate a master security account to receive all alerts from the child accounts. Set up specific rules within Amazon Even;Bridge to trigger an AWS Lambda function for remediation steps.

Answer

Ingest all AWS CloudTrail logs, VPC Flow Logs, and DNS logs into a single Amazon S3 bucket in a designated security account. Use the current on-premises SIEM to monitor the logs and send a notification to an Amazon SNS topic to alert the security team of remediation steps.

Answer

Ingest all AWS CloudTrail logs, VPC Flow Logs, and DNS logs into a single Amazon S3 bucket in a designated security account. Launch an Amazon EC2 instance and install the current SIEM to monitor the logs and send a notification to an Amazon SNS topic to alert the security team of remediation steps.

Answer

Enable Amazon GuardDuty and AWS Security Hub in all Regions and all accounts. Designate a master security account to receive all alerts from the child accounts. Create an AWS Organizations SCP that denies access to certain API calls that are on an ignore list.

Question 12

A company has multiple AWS accounts that are part of AW5 Organizations. The company's Security team wants to ensure that even those Administrators with full access to the company's AWS accounts are unable to access the company's Amazon S3 buckets How should this be accomplished?

Accepted Answer

UseSCPs

Answer

Add a permissions boundary to deny access to Amazon S3 and attach it to all roles

Answer

Use an S3 bucket policy

Answer

Create a VPC endpoint for Amazon S3 and deny statements for access to Amazon S3

Question 13

A company has an AWS account and allows a third-party contractor who uses another AWS account, to assume certain IAM roles. The company wants to ensure that IAM roles can be assumed by the contractor only if the contractor has multi-factor authentication enabled on their IAM user accounts What should the company do to accomplish this?

Accepted Answer

Question 14

Two Amazon EC2 instances in different subnets should be able to connect to each other but cannot. It has been confirmed that other hosts in the same subnets are able to communicate successfully, and that security groups have valid ALLOW rules in place to permit this traffic.Which of the following troubleshooting steps should be performed?

Accepted Answer

Review the rejected packet reason codes in the VPC Flow Logs.

Answer

Check inbound and outbound security groups, looking for DENY rules.

Answer

Check inbound and outbound Network ACL rules, looking for DENY rules.

Answer

Use AWS X-Ray to trace the end-to-end application flow

Question 15

An application developer is using an AWS Lambda function that must use AWS KMS to perform encrypt and decrypt operations for API keys that are less than 2 KB Which key policy would allow the application to do this while granting least privilege?<img alt="Amazon SCS-C01 image Question 55 7173 09162024005923000000"   width="1187" height="1213" src="https://examgecko.com/getfile/e054999c-2a09-4032-b8d4-e555a49143bf">

Accepted Answer

Option C

Answer

Option A

Answer

Option B

Answer

Option D

Question 16

A company is collecting AWS CloudTrail log data from multiple AWS accounts by managing individual trails in each account and forwarding log data to a centralized Amazon S3 bucket residing in a log archive account. After CloudTrail introduced support for AWS Organizations trails, the company decided to further centralize management and automate deployment of the CloudTrail logging capability across all of its AWS accounts. The company's security engineer created an AWS Organizations trail in the master account, enabled server-side encryption with AWS KMS managed keys (SSE-KMS) for the log files, and specified the same bucket as the storage location. However, the engineer noticed that logs recorded by the new trail were not delivered to the bucket.Which factors could cause this issue? (Select TWO.)

Accepted Answer

The CMK key policy does not allow CloudTrail to make encrypt and decrypt API calls against the key.

Accepted Answer

The S3 bucket policy does not allow CloudTrail to make PutObject API calls against a folder created for the Organizations trail.

Answer

The CMK key policy does not allow CloudTrail to make GenerateDataKey API calls against the key.

Answer

The IAM role used by the CloudTrail trail does not have permissions to make PutObject API calls against a folder created for the Organizations trail.

Answer

The CMK key policy does not allow the IAM role used by the CloudTrail trail to use the key for crypto graphicaI operations.

Question 17

A Security Engineer has several thousand Amazon EC2 instances split across production and development environments. Each instance is tagged with its environment. The Engineer needs to analyze and patch all the development EC2 instances to ensure they are not currently exposed to any common vulnerabilities or exposures (CVEs) Which combination of steps is the MOST efficient way for the Engineer to meet these requirements? (Select TWO.)

Accepted Answer

Install the Amazon Inspector agent on all development instances Configure Inspector to perform a scan using the CVE rule package on all instances tagged as being in the development environment.

Accepted Answer

Install the Amazon EC2 System Manager agent on all development instances Issue the Run command to EC2 System Manager to update all instances

Answer

Log on to each EC2 instance, check and export the different software versions installed, and verify this against a list of current CVEs.

Answer

Install the Amazon Inspector agent on all development instances Build a custom rule package, and configure Inspector to perform a scan using this custom rule on all instances tagged as being in the development environment.

Answer

Use AWS Trusted Advisor to check that all EC2 instances have been patched to the most recent version of operating system and installed software.

Question 18

A company's architecture requires that its three Amazon EC2 instances run behind an Application Load Balancer (ALB). The EC2 instances transmit sensitive data between each other Developers use SSL certificates to encrypt the traffic between the public users and the ALB However the Developers are unsure of how to encrypt the data in transit between the ALB and the EC2 instances and the traffic between the EC2 instances Which combination of activities must the company implement to meet its encryption requirements'?(Select TWO )

Accepted Answer

Ensure that all resources are in the same VPC so the default encryption provided by the VPC is used to encrypt the traffic between the EC2 instances.

Accepted Answer

In the ALB. select the default encryption to encrypt the traffic between the ALB and the EC2 instances

Answer

Configure SSLTLS on the EC2 instances and configure the ALB target group to use HTTPS

Answer

In the code for the application, include a cryptography library and encrypt the data before sending it between the EC2 instances

Answer

Configure AWS Direct Connect to provide an encrypted tunnel between the EC2 instances

Question 19

A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer(ALB). The instances are in an EC2 Auto Scaling group across multiple Availability Zones. The website is under a DDoS attack by a specific loT device brand that is visible in the user agent A security engineer needs to mitigate the attack without impacting the availability of the public website.What should the security engineer do to accomplish this?

Accepted Answer

Activate AWS Shield Advanced to enable DDoS protection. Apply an AWS WAF ACL to the ALB. and configure a listener rule on the ALB to block loT devices based on the user agent.

Answer

Configure a web ACL rule for AWS WAF to block requests with a string match condition for the user agent of the loT device. Associate the v/eb ACL with the ALB.

Answer

Configure an Amazon CloudFront distribution to use the ALB as an origin. Configure a web ACL rule for AWS WAF to block requests with a string match condition for the user agent of the loT device. Associate the web ACL with the ALB Change the public DNS entry of the website to point to the CloudFront distribution.

Answer

Configure an Amazon CloudFront distribution to use a new ALB as an origin. Configure a web ACL rule for AWS WAF to block requests with a string match condition for the user agent of the loT device. Change the ALB security group to alow access from CloudFront IP address ranges only Change the public DNS entry of the website to point to the CloudFront distribution.

Question 20

An company is using AWS Secrets Manager to store secrets that are encrypted using a CMK and are stored in the security account 111122223333. One of the company's production accounts. 444455556666, must to retrieve the secret values from the security account 111122223333. A security engineer needs to apply a policy to the secret in the security account based on least privilege access so the production account can retrieve the secret value only.<img alt="Amazon SCS-C01 image Question 60 7178 09162024005923000000"   width="822" height="1054" src="https://examgecko.com/getfile/b48614e9-ea74-4a01-b2db-6e0dae76495b">Which policy should the security engineer apply?

Accepted Answer

Option A

Answer

Option B

Answer

Option C

Answer

Option D

Question 21

A company's Developers plan to migrate their on-premises applications to Amazon EC2 instances running Amazon Linux AMIs. The applications are accessed by a group of partner companies The Security Engineer needs to implement the following host-based security measures for these instances:• Block traffic from documented known bad IP addresses• Detect known software vulnerabilities and CIS Benchmarks compliance.Which solution addresses these requirements?

Accepted Answer

Launch the EC2 instances with an IAM role attached Include a user data script that creates a cron job to periodically retrieve the list of bad IP addresses from Amazon S3, and configures iptabies on the instances blocking the list of bad IP addresses Use Amazon inspector to scan the instances for known software vulnerabilities and CIS Benchmarks compliance.

Answer

Launch the EC2 instances with an IAM role attached. Include a user data script that uses the AWS CLI to retrieve the list of bad IP addresses from AWS Secrets Manager and uploads it as a threat list in Amazon GuardDuty Use Amazon Inspector to scan the instances for known software vulnerabilities and CIS Benchmarks compliance

Answer

Launch the EC2 instances with an IAM role attached Include a user data script that uses the AWS CLl to create NACLs blocking ingress traffic from the known bad IP addresses in the EC2 instance's subnets Use AWS Systems Manager to scan the instances for known software vulnerabilities, and AWS Trusted Advisor to check instances for CIS Benchmarks compliance

Answer

Launch the EC2 instances with an IAM role attached Include a user data script that uses the AWS CLl to create and attach security groups that only allow an allow listed source IP address range inbound. Use Amazon Inspector to scan the instances for known software vulnerabilities, and AWS Trusted Advisor to check instances for CIS Benchmarks compliance

Question 22

A company has an encrypted Amazon S3 bucket. An Application Developer has an IAM policy that allows access to the S3 bucket, but the Application Developer is unable to access objects within the bucket. What is a possible cause of the issue?

Accepted Answer

The S3 bucket policy fails to explicitly grant access to the Application Developer

Answer

The S3 ACL for the S3 bucket fails to explicitly grant access to the Application Developer

Answer

The AWS KMS key for the S3 bucket fails to list the Application Developer as an administrator

Answer

The S3 bucket policy explicitly denies access to the Application Developer

Question 23

A company has a VPC with several Amazon EC2 instances behind a NAT gateway. The company's security policy states that all network traffic must be logged and must include the original source and destination IP addresses. The existing VPC Flow Logs do not include this information. A security engineer needs to recommend a solution.Which combination of steps should the security engineer recommend? (Select TWO )

Accepted Answer

Edit the existing VPC Flow Logs. Change the log format of the VPC Flow Logs from the Amazon default format to a custom format.

Accepted Answer

Include the subnet-id and instance-id fields in the log format.

Answer

Delete and recreate the existing VPC Flow Logs. Change the log format of the VPC Flow Logs from the Amazon default format to a custom format.

Answer

Change the destination to Amazon CloudWatch Logs.

Answer

Include the pkt-srcaddr and pkt-dstaddr fields in the log format.

Question 24

A developer is creating an AWS Lambda function that requires environment variables to store connection information and logging settings. The developer is required to use an AWS KMS Customer Master Key (CMK> supplied by the information security department in order to adhere to company standards for securing Lambda environment variables. Which of the following are required for this configuration to work? (Select TWO.)

Accepted Answer

The Lambda function execution role must have the kms:Decrypt- permission added in the AWS IAM policy.

Accepted Answer

The KMS key policy must allow permissions for the developer to use the KMS key.

Answer

The developer must configure Lambda access to the VPC using the --vpc-config parameter.

Answer

The AWS IAM policy assigned to the developer must have the kmseGcnerate-DataKcy permission added.

Answer

The Lambda execution role must have the kms:Encrypt permission added in the AWS IAM policy.

Question 25

A Solutions Architect is designing a web application that uses Amazon CloudFront, an Elastic Load Balancing Application Load Balancer, and an Auto Scaling group of Amazon EC2 instances. The load balancer and EC2 instances are in the US West (Oregon) region. It has been decided that encryption in transit is necessary by using a customer-branded domain name from the client to CloudFront and from CloudFront to the load balancer. Assuming that AWS Certificate Manager is used, how many certificates will need to be generated?

Accepted Answer

One in the US West (Oregon) region and one in the US East (Virginia) region.

Answer

Two in the US West (Oregon) region and none in the US East (Virginia) region.

Answer

One in the US West (Oregon) region and none in the US East (Virginia) region.

Answer

Two in the US East (Virginia) region and none in the US West (Oregon) region.

Question 26

Unapproved changes were previously made to a company's Amazon S3 bucket. A security engineer configured AWS Config to record configuration changes made to the company's S3 buckets. The engineer discovers there are S3 configuration changes being made, but no Amazon SNS notifications are being sent. The engineer has already checked the configuration of the SNS topic and has confirmed the configuration is valid. Which combination of steps should the security engineer take to resolve the issue? (Select TWO.)

Accepted Answer

Configure policies attached to S3 buckets to allow AWS Config to record changes to the buckets.

Accepted Answer

Assign the AWSConfigRole managed policy to the AWS Config role

Answer

Configure the S3 bucket ACLs to allow AWS Config to record changes to the buckets.

Answer

Attach the AmazonS3ReadOnryAccess managed policy to the IAM user.

Answer

Verify the security engineer's IAM user has an attached policy that allows all AWS Config actions.

Question 27

A company has a serverless application for internal users deployed on AWS. The application uses AWS Lambda for the front end and for business logic. The Lambda function accesses an Amazon RDS database inside a VPC The company uses AWS Systems Manager Parameter Store for storing database credentials. A recent security review highlighted the following issues The Lambda function has internet access. The relational database is publicly accessible.The database credentials are not stored in an encrypted state.Which combination of steps should the company take to resolve these security issues? (Select THREE)

Accepted Answer

Disable public access to the RDS database inside the VPC

Accepted Answer

Move all the Lambda functions inside the VPC.

Accepted Answer

Edit the IAM role used by RDS to restrict internet access.

Answer

Edit the IAM role used by Lambda to restrict internet access.

Answer

Create a VPC endpoint for Systems Manager. Store the credentials as a string parameter. Change the parameter type to an advanced parameter.

Answer

Create a VPC endpoint for Systems Manager. Store the credentials as a SecureString parameter.

Question 28

A company's Security Officer is concerned about the risk of AWS account root user logins and has assigned a Security Engineer to implement a notification solution for near-real-time alerts upon account root user logins. How should the Security Engineer meet these requirements?

Accepted Answer

Run AWS CloudTrail logs through Amazon CloudWatch Events to detect account roo4 user logins and trigger an AWS Lambda function to send an Amazon SNS notification to the Security team's distribution list.

Answer

Create a cron job that runs a script lo download the AWS IAM security credentials We. parse the file for account root user logins and email the Security team's distribution 1st

Answer

Save AWS CloudTrail logs to an Amazon S3 bucket in the Security team's account Process the CloudTrail logs with the Security Engineer's logging solution for account root user logins Send an Amazon SNS notification to the Security team upon encountering the account root user login events

Answer

Save VPC Plow Logs to an Amazon S3 bucket in the Security team's account and process the VPC Flow Logs with their logging solutions for account root user logins Send an Amazon SNS notification to the Security team upon encountering the account root user login events

Question 29

A company uses HTTP Live Streaming (HLS) to stream live video content to paying subscribers byusing Amazon CloudFront. HLS splits the video content into chunks so that the user can request theright chunk based on different conditions Because the video events last for several hours, the totalvideo is made up of thousands of chunksThe origin URL is not disclosed and every user is forced to access the CloudFront URL The companyhas a web application that authenticates the paying users against an internal repository and aCloudFront key pair that is already issued.What is the simplest and MOST effective way to protect the content?

Accepted Answer

Develop the application to use the CloudFront key pair to set the signed cookies that users will use to access the content.

Answer

Develop the application to use the CloudFront key pair to create signed URLs that users will use to access the content.

Answer

Develop the application to issue a security token that Lambda@Edge will receive to authenticate and authorize access to the content

Answer

Keep the CloudFront URL encrypted inside the application, and use AWS KMS to resolve the URL on-the-fly after the user is authenticated.

Question 30

A company has the software development teams that are creating applications that store sensitive data in Amazon S3 Each team's data must always be separate. The company's security team must design a data encryption strategy for both teams that provides the ability to audit key usage. The solution must also minimize operational overhead what should me security team recommend?

Accepted Answer

Tell the application teams to use two different S3 buckets with separate AWS Key Management Service (AWS KMS) AWS managed CMKs Limit the key process to allow encryption and decryption of the CMKs to their respective teams only. Force the teams to use encryption context to encrypt and decrypt

Answer

Tell the application teams to use two different S3 buckets with a single AWS Key Management Service (AWS KMS) AWS managed CMK Limit the key policy to allow encryption and decryption of the CMK only. Do not allow the teams to use encryption context to encrypt and decrypt

Answer

Tell the application teams to use two different S3 buckets with separate AWS Key Management Service (AWS KMS) customer managed CMKs Limit the key policies to allow encryption and decryption of the CMKs to their respective teams only Force the teams to use encryption context to encrypt and decrypt

Answer

Tell the application teams to use two different S3 buckets with a single AWS Key Management Service (AWS KMS) customer managed CMK Limit the key policy to allow encryption and decryption of the CMK only Do not allow the teams to use encryption context to encrypt and decrypt

Question 31

Authorized Administrators are unable to connect to an Amazon EC2 Linux bastion host using SSH over the internet. The connection either fails to respond or generates the following error message:Network error: Connection timed out.What could be responsible for the connection failure? (Select THREE )

Accepted Answer

The internet gateway of the VPC has been reconfigured

Accepted Answer

The route table is missing a route to the internet gateway

Accepted Answer

The host-based firewall is denying SSH traffic

Answer

The NAT gateway in the subnet where the EC2 instance is deployed has been misconfigured

Answer

The security group denies outbound traffic on ephemeral ports

Answer

The NACL denies outbound traffic on ephemeral ports

Question 32

A company's Security Engineer has been asked to monitor and report all AWS account root user activities. Which of the following would enable the Security Engineer to monitor and report all root user activities? (Select TWO)

Accepted Answer

Creating an Amazon CloudWatch Events rule that will trigger when any API call from the root user is reported

Accepted Answer

Using Amazon SNS to notify the target group

Answer

Configuring AWS Organizations to monitor root user API calls on the paying account

Answer

Configuring Amazon Inspector to scan the AWS account for any root user activity

Answer

Configuring AWS Trusted Advisor to send an email to the Security team when the root user logs in to the console

Question 33

The Security Engineer is managing a traditional three-tier web application that is running on Amazon EC2 instances. The application has become the target of increasing numbers of malicious attacks from the Internet. What steps should the Security Engineer take to check for known vulnerabilities and limit the attack surface? (Choose two.)

Accepted Answer

Review the application security groups to ensure that only the necessary ports are open.

Accepted Answer

Use Amazon Inspector to periodically scan the backend instances.

Answer

Use AWS Certificate Manager to encrypt all traffic between the client and application servers.

Answer

Use Elastic Load Balancing to offload Secure Sockets Layer encryption.

Answer

Use AWS Key Management Services to encrypt all the traffic between the client and application servers.

Question 34

After a recent security audit involving Amazon S3, a company has asked assistance reviewing its S3 buckets to determine whether data is properly secured. The first S3 bucket on the list has the following bucket policy.<img alt="Amazon SCS-C01 image Question 74 7192 09162024005923000000"   width="766" height="423" src="https://examgecko.com/getfile/a4d4e3f5-f62e-4aee-93a9-ec50d8ec8724">Is this bucket policy sufficient to ensure that the data is not publicity accessible?

Accepted Answer

Yes, the bucket policy makes the whole bucket publicly accessible despite now the S3 bucket ACL or object ACLs are configured.

Answer

Yes, none of the data in the bucket is publicity accessible, regardless of how the S3 bucket ACL and object ACLs are configured.

Answer

No, the IAM user policy would need to be examined first to determine whether any data is publicly accessible.

Answer

No, the S3 bucket ACL and object ACLs need to be examined first to determine whether any data is publicly accessible.

Question 35

A company is using AWS Organizations to manage multiple AWS member accounts. All of these accounts have Amazon GuardDuty enabled in all Regions. The company's AW5 Security Operations Center has a centralized security account for logging and monitoring. One of the member accounts has received an excessively high bill A security engineer discovers that a compromised Amazon EC2 instance is being used to mine crypto currency. The Security Operations Center did not receive a GuardDuty finding in the central security account. but there was a GuardDuty finding in the account containing the compromised EC2 instance. The security engineer needs to ensure an GuardDuty finding are available in the security account.What should the security engineer do to resolve this issue?

Accepted Answer

Use the aws GuardDuty get-members AWS CLI command m the security account to see if the account is listed Send an invitation from GuardDuty m the security account to GuardDuty in the compromised account Accept the invitation to forward all future GuardDuty findings

Answer

Set up an Amazon CloudWatch Event rule to forward ail GuardDuty findings to the security account Use an AWS Lambda function as a target to raise findings

Answer

Set up an Amazon CloudWatch Events rule to forward all GuardDuty findings to the security account Use an AWS Lambda function as a target to raise findings in AWS Security Hub

Answer

Check that GuardDuty in the security account is able to assume a role in the compromised account using the GuardDuty fast findings permission Schedule an Amazon CloudWatch Events rule and an AWS Lambda function to periodically check for GuardDuty findings

Question 36

A Developer signed in to a new account within an AWS Organizations organizations unit (OU) containing multiple accounts. Access to the Amazon S3 service is restricted with the following SCP:<img alt="Amazon SCS-C01 image Question 76 7194 09162024005923000000"   width="766" height="423" src="https://examgecko.com/getfile/9ba78e41-8e8f-4d09-a83d-7ef429c87502">How can the Security Engineer provide the Developer with Amazon S3 access without affecting other accounts?

Accepted Answer

Create a new OU without applying the SCP restricting S3 access. Move the Developer account to this new OU.

Answer

Move the SCP to the root OU of Organizations to remove the restriction to access Amazon S3.

Answer

Add an IAM policy for the Developer, which grants S3 access.

Answer

Add an allow list for the Developer account for the S3 service.

Question 37

A Security Engineer launches two Amazon EC2 instances in the same Amazon VPC but in separate Availability Zones. Each instance has a public IP address and is able to connect to external hosts on the internet. The two instances are able to communicate with each other by using their private IP addresses, but they are not able to communicate with each other when using their public IP addresses. Which action should the Security Engineer take to allow communication over the public IP addresses?

Accepted Answer

Add the public IP addresses to the ingress rules of the instance security groups.

Answer

Associate the instances to the same security groups.

Answer

Add 0.0.0.0/0 to the egress rules of the instance security groups.

Answer

Add the instance IDs to the ingress rules of the instance security groups.

Question 38

A Developer reported that AWS CloudTrail was disabled on their account. A Security Engineer investigated the account and discovered the event was undetected by the current security solution. The Security Engineer must recommend a solution that will detect future changes to the CloudTrail configuration and send alerts when changes occur. What should the Security Engineer do to meet these requirements?

Accepted Answer

Create an Amazon CloudWatch Events rule to monitor Amazon GuardDuty findings. Send email notifications using Amazon SNS.

Answer

Use AWS Resource Access Manager (AWS RAM) to monitor the AWS CloudTrail configuration.Send notifications using Amazon SNS.

Answer

Update security contact details in AWS account settings for AWS Support to send alerts when suspicious activity is detected.

Answer

Use Amazon Inspector to automatically detect security issues. Send alerts using Amazon SNS.

Question 39

A security engineer is designing an incident response plan to address the risk of a compromised Amazon EC2 instance. The plan must recommend a solution to meet the following requirements:• A trusted forensic environment must be provisioned• Automated response processes must be orchestratedWhich AWS services should be included in the plan? {Select TWO)

Accepted Answer

AWS CloudFormation

Accepted Answer

AWS Step Functions

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

Amazon Macie

Question 40

A company uses multiple AWS accounts managed with AWS Organizations Security engineers have created a standard set of security groups for all these accounts. The security policy requires that these security groups be used for all applications and delegates modification authority to the security team only.A recent security audit found that the security groups are inconsistency implemented across accounts and that unauthorized changes have been made to the security groups. A security engineer needs to recommend a solution to improve consistency and to prevent unauthorized changes in the individual accounts in the future.Which solution should the security engineer recommend?

Accepted Answer

Create an AWS CloudFormation template that creates the required security groups Execute the template as part of configuring new accounts Enable Amazon Simple Notification Service (Amazon SNS) notifications when changes occur

Answer

Use AWS Resource Access Manager to create shared resources for each requited security group and apply an IAM policy that permits read-only access to the security groups only.

Answer

Use AWS Firewall Manager to create a security group policy, enable the policy feature to identify and revert local changes, and enable automatic remediation

Answer

Use AWS Control Tower to edit the account factory template to enable the snare security groups option Apply an SCP to the OU or individual accounts that prohibits security group modifications from local account users

Amazon SCS-C01 Practice Test 2

Amazon SCS-C01 Practice Tests