Your company has an EC2 Instance that is hosted in an AWS VPC. There is a requirement to ensure that logs files from the EC2 Instance are stored accordingly. The access should also be limited for the destination of the log files. How can this be accomplished? Choose 2 answers from the options given below. Each answer forms part of the solution Please select:

Stream the log files to a separate Cloudwatch Log group

Create an IAM policy that gives the desired level of access to the Cloudwatch Log group

Stream the log files to a separate Cloudtrail trail

Stream the log files to a separate Cloudwatch Log group

Create an IAM policy that gives the desired level of access to the Cloudtrail trail

Create an IAM policy that gives the desired level of access to the Cloudwatch Log group

You have an Ec2 Instance in a private subnet which needs to access the KMS service. Which of the following methods can help fulfil this requirement, keeping security in perspective Please select:

Attach an Internet gateway to the subnet

Attach a VPN connection to the VPC

Your company has a set of resources defined in the AWS Cloud. Their IT audit department has requested to get a list of resources that have been defined across the account. How can this be achieved in the easiest manner? Please select:

Use AWS Config to get the list of all resources

Create a powershell script using the AWS CLI. Query for all resources with the tag of production.

Create a bash shell script with the AWS CLI. Query for all resources in all regions. Store the results in an S3 bucket.

Use Cloud Trail to get the list of all resources

Use AWS Config to get the list of all resources

A Lambda function reads metadata from an S3 object and stores the metadata in a DynamoDB table.The function is triggered whenever an object is stored within the S3 bucket.How should the Lambda function be given access to the DynamoDB table?Please select:

Create an IAM service role with permissions to write to the DynamoDB table. Associate that role with the Lambda function.

Create a VPC endpoint for DynamoDB within a VPC. Configure the Lambda function to access resources in the VPC.

Create a resource policy that grants the Lambda function permissions to write to the DynamoDB table. Attach the poll to the DynamoDB table.

Create an IAM user with permissions to write to the DynamoDB table. Store an access key for that user in the Lambda environment variables.

Create an IAM service role with permissions to write to the DynamoDB table. Associate that role with the Lambda function.

Your company has defined privileged users for their AWS Account. These users are administrators for key resources defined in the company. There is now a mandate to enhance the security authentication for these users. How can this be accomplished?Please select:

Enable MFA for these user accounts

Enable versioning for these user accounts

Enable accidental deletion for these user accounts

Disable root access for the users

An application running on EC2 instances must use a username and password to access a database.The developer has stored those secrets in the SSM Parameter Store with type SecureString using the default KMS CMK. Which combination of configuration steps will allow the application to access the secrets via the API? Select 2 answers from the options below Please select:

Add permission to read the SSM parameter to the EC2 instance role..

Add permission to use the KMS key to decrypt to the EC2 instance role

Add the EC2 instance role as a trusted service to the SSM service role.

Add permission to use the KMS key to decrypt to the SSM service role.

Add permission to read the SSM parameter to the EC2 instance role..

Add permission to use the KMS key to decrypt to the EC2 instance role

Add the SSM service role as a trusted service to the EC2 instance role.

You have a 2 tier application hosted in AWS. It consists of a web server and database server (SQL Server) hosted on separate EC2 Instances. You are devising the security groups for these EC2 Instances. The Web tier needs to be accessed by users across the Internet. You have created a web security group(wg-123) and database security group(db-345). Which combination of the following security group rules will allow the application to be secure and functional. Choose 2 answers from the options given below.Please select:

wg-123 -Allow ports 80 and 443 from 0.0.0.0/0

db-345 - Allow port 1433 from wg-123

wg-123 -Allow ports 80 and 443 from 0.0.0.0/0

db-345 - Allow port 1433 from wg-123

wg-123 - Allow port 1433 from wg-123

db-345 -Allow ports 1433 from 0.0.0.0/0

You are deivising a policy to allow users to have the ability to access objects in a bucket called appbucket. You define the below custom bucket policy But when you try to apply the policy you get the error "Action does not apply to any resource(s) in statement." What should be done to rectify the error Please select:

Change the Resource section to "arn:aws:s3:::appbucket/*'.

Change the IAM permissions by applying PutBucketPolicy permissions.

Verify that the policy has the same name as the bucket name. If not. make it the same.

Change the Resource section to "arn:aws:s3:::appbucket/*'.

Create the bucket "appbucket" and then apply the policy.

A company wants to have an Intrusion detection system available for their VPC in AWS. They want to have complete control over the system. Which of the following would be ideal to implement? Please select:

Use a custom solution available in the AWS Marketplace

Use AWS WAF to catch all intrusions occurring on the systems in the VPC

Use a custom solution available in the AWS Marketplace

Use VPC Flow logs to detect the issues and flag them accordingly.

Use AWS Cloudwatch to monitor all traffic

You have an S3 bucket hosted in AWS. This is used to host promotional videos uploaded by yourself.You need to provide access to users for a limited duration of time. How can this be achieved?Please select:

Use versioning and enable a timestamp for each version

Use IAM Roles with a timestamp to limit the access

Use IAM policies with a timestamp to limit the access

Your company has mandated that all calls to the AWS KMS service be recorded. How can this be achieved? Please select:

Enable logging on the KMS service

You want to get a list of vulnerabilities for an EC2 Instance as per the guidelines set by the Center of Internet Security. How can you go about doing this? Please select:

Enable AWS Guard Duty for the Instance

You have an instance setup in a test environment in AWS. You installed the required application and the promoted the server to a production environment. Your IT Security team has advised that there maybe traffic flowing in from an unknown IP address to port 22. How can this be mitigated immediately?Please select:

Remove the rule for incoming traffic on port 22 for the Security Group

Change the AMI for the instance

Change the Instance type for the instance

Your company has defined a number of EC2 Instances over a period of 6 months. They want to know if any of the security groups allow unrestricted access to a resource. What is the best option to accomplish this requirement? Please select:

Use the AWS Trusted Advisor to see which security groups have compromised access.

Use AWS Inspector to inspect all the security Groups

Use the AWS Trusted Advisor to see which security groups have compromised access.

Use AWS Config to see which security groups have compromised access.

Use the AWS CLI to query the security groups and then filter for the rules which have unrestricted accessd

A company is using CloudTrail to log all AWS API activity for all regions in all of its accounts. The CISO has asked that additional steps be taken to protect the integrity of the log files. What combination of steps will protect the log files from intentional or unintentional alteration?Choose 2 answers from the options given belowPlease select:

Create an S3 bucket in a dedicated log account and grant the other accounts write only access.Deliver all log files from every account to this S3 bucket.

Enable CloudTrail log file integrity validation

Create an S3 bucket in a dedicated log account and grant the other accounts write only access.Deliver all log files from every account to this S3 bucket.

Write a Lambda function that queries the Trusted Advisor Cloud Trail checks. Run the function every 10 minutes.

Enable CloudTrail log file integrity validation

Use Systems Manager Configuration Compliance to continually monitor the access policies of S3 buckets containing Cloud Trail logs.

Create a Security Group that blocks all traffic except calls from the CloudTrail service. Associate the security group with) all the Cloud Trail destination S3 buckets.

You have just received an email from AWS Support stating that your AWS account might have been compromised. Which of the following steps would you look to carry out immediately. Choose 3 answers from the options below. Please select:

Change the root account password.

Change the password for all IAM users.

Change the root account password.

Keep all resources running to avoid disruption

Change the password for all IAM users.

Your IT Security team has advised to carry out a penetration test on the resources in their company's AWS Account. This is as part of their capability to analyze the security of the Infrastructure. What should be done first in this regard? Please select:

Submit a request to AWS Support

Turn on Cloud trail and carry out the penetration test

Turn on VPC Flow Logs and carry out the penetration test

Submit a request to AWS Support

Use a custom AWS Marketplace solution for conducting the penetration test

Your company is planning on hosting an internal network in AWS. They want machines in the VPC to authenticate using private certificates. They want to minimize the work and maintenance in working with certificates. What is the ideal way to fulfil this requirement.Please select:

Consider using AWS Certificate Manager

Consider using Windows Server 2016 Certificate Manager

Consider using AWS Certificate Manager

Consider using AWS Access keys to generate the certificates

Consider using AWS Trusted Advisor for managing the certificates

You have enabled Cloudtrail logs for your company's AWS account. In addition, the IT Security department has mentioned that the logs need to be encrypted. How can this be achieved? Please select:

There is no need to do anything since the logs will already be encrypted

Enable SSL certificates for the Cloudtrail logs

There is no need to do anything since the logs will already be encrypted

Enable Server side encryption for the trail

Enable Server side encryption for the destination S3 bucket

You have just recently set up a web and database tier in a VPC and hosted the application. When testing the app , you are not able to reach the home page for the app. You have verified the security groups. What can help you diagnose the issue.Please select:

Use VPC Flow logs to diagnose the traffic

Use the AWS Trusted Advisor to see what can be done.

Use VPC Flow logs to diagnose the traffic

Use AWS WAF to analyze the traffic

Use AWS Guard Duty to analyze the traffic

A security team is creating a response plan in the event an employee executes unauthorized actions on AWS infrastructure. They want to include steps to determine if the employee's IAM permissions changed as part of the incident. What steps should the team document in the plan?Please select:

Use AWS Config to examine the employee's IAM permissions prior to the incident and compare them to the employee's current IAM permissions.

Use Made to examine the employee's IAM permissions prior to the incident and compare them to the employee's A current IAM permissions.

Use CloudTrail to examine the employee's IAM permissions prior to the incident and compare them to the employee's current IAM permissions.

Use Trusted Advisor to examine the employee's IAM permissions prior to the incident and compare them to the employee's current IAM permissions.

A security team must present a daily briefing to the CISO that includes a report of which of the company's thousands of EC2 instances and on-premises servers are missing the latest security patches. All instances/servers must be brought into compliance within 24 hours so they do not show up on the next day's report. How can the security team fulfill these requirements? Please select:

Use Systems Manger Patch Manger to generate the report of out of compliance instances/ servers.Use Systems Manager Patch Manger to install the missing patches.

Use Amazon QuickSight and Cloud Trail to generate the report of out of compliance instances/servers. Redeploy all out of compliance instances/servers using an AMI with the latest patches.

Use Systems Manger Patch Manger to generate the report of out of compliance instances/ servers.Use Systems Manager Patch Manger to install the missing patches.

Use Systems Manger Patch Manger to generate the report of out of compliance instances/ servers.Redeploy all out of1 compliance instances/servers using an AMI with the latest patches.

Use Trusted Advisor to generate the report of out of compliance instances/servers. Use Systems Manger Patch Manger to install the missing patches.

Your development team has started using AWS resources for development purposes. The AWS account has just been created. Your IT Security team is worried about possible leakage of AWS keys. What is the first level of measure that should be taken to protect the AWS account.Please select:

Delete the AWS keys for the root account

Restrict access using IAM policies

Which of the following is not a best practice for carrying out a security audit?Please select:

Conduct an audit on a yearly basis

Conduct an audit if application instances have been added to your account

Conduct an audit if you ever suspect that an unauthorized person might have accessed your account

Whenever there are changes in your organization

A company hosts a critical web application on the AWS Cloud. This is a key revenue generating application for the company. The IT Security team is worried about potential DDos attacks against the web site. The senior management has also specified that immediate action needs to be taken in case of a potential DDos attack. What should be done in this regard? Please select:

Consider using the AWS Shield Advanced Service

Consider using the AWS Shield Service

Consider using VPC Flow logs to monitor traffic for DDos attack and quickly take actions on a trigger of a potential attack.

Consider using the AWS Shield Advanced Service

Consider using Cloudwatch logs to monitor traffic for DDos attack and quickly take actions on a trigger of a potential attack.

You have setup a set of applications across 2 VPC's. You have also setup VPC Peering. The applications are still not able to communicate across the Peering connection. Which network troubleshooting steps should be taken to resolve the issue?Please select:

Check the Route tables for the VPC's

Ensure the applications are hosted in a public subnet

Check to see if the VPC has an Internet gateway attached.

Check to see if the VPC has a NAT gateway attached.

Check the Route tables for the VPC's

A company requires that data stored in AWS be encrypted at rest. Which of the following approaches achieve this requirement? Select 2 answers from the options given below. Please select:

When storing data in EBS, encrypt the volume by using AWS KMS.

When storing data in S3, enable server-side encryption.

When storing data in Amazon EBS, use only EBS-optimized Amazon EC2 instances.

When storing data in EBS, encrypt the volume by using AWS KMS.

When storing data in Amazon S3, use object versioning and MFA Delete.

When storing data in Amazon EC2 Instance Store, encrypt the volume by using KMS.

When storing data in S3, enable server-side encryption.

You need to ensure that objects in an S3 bucket are available in another region. This is because of the criticality of the data that is hosted in the S3 bucket. How can you achieve this in the easiest way possible? Please select:

Enable cross region replication for the bucket

Write a script to copy the objects to another bucket in the destination region

Create an S3 snapshot in the destination region

Enable versioning which will copy the objects to the destination region

A company has a legacy application that outputs all logs to a local text file. Logs from all applications running on AWS must be continually monitored for security related messages. What can be done to allow the company to deploy the legacy application on Amazon EC2 and still meet the monitoring requirement? Please select:

Send the local text log files to CloudWatch Logs and configure a CloudWatch metric filter. Trigger cloudwatch alarms based on the metrics.

Create a Lambda function that mounts the EBS volume with the logs and scans the logs for security incidents. Trigger the function every 5 minutes with a scheduled Cloudwatch event.

Send the local text log files to CloudWatch Logs and configure a CloudWatch metric filter. Trigger cloudwatch alarms based on the metrics.

Install the Amazon inspector agent on any EC2 instance running the legacy application. Generate CloudWatch alerts a based on any Amazon inspector findings.

Export the local text log files to CloudTrail. Create a Lambda function that queries the CloudTrail logs for security ' incidents using Athena.

Every application in a company's portfolio has a separate AWS account for development and production. The security team wants to prevent the root user and all IAM users in the production accounts from accessing a specific set of unneeded services. How can they control this functionality?Please select:

Create a Service Control Policy that denies access to the services. Assemble all production accounts in an organizational unit. Apply the policy to that organizational unit.

Create a Service Control Policy that denies access to the services. Apply the policy to the root account.

Create an IAM policy that denies access to the services. Associate the policy with an IAM group and enlist all users and the root users in this group.

Create an IAM policy that denies access to the services. Create a Config Rule that checks that all users have the policy m assigned. Trigger a Lambda function that adds the policy when found missing.

An application running on EC2 instances in a VPC must call an external web service via TLS (port 443). The instances run in public subnets.Which configurations below allow the application to function and minimize the exposure of the instances? Select 2 answers from the options given below Please select:

A network ACL with rules that allow outgoing traffic on port 443 and incoming traffic on ephemeral ports

A security group with a rule that allows outgoing traffic on port 443

A network ACL with a rule that allows outgoing traffic on port 443.

A network ACL with rules that allow outgoing traffic on port 443 and incoming traffic on ephemeral ports

A network ACL with rules that allow outgoing traffic on port 443 and incoming traffic on port 443.

A security group with a rule that allows outgoing traffic on port 443

A security group with rules that allow outgoing traffic on port 443 and incoming traffic on ephemeral ports.

A security group with rules that allow outgoing traffic on port 443 and incoming traffic on port 443.

A company is deploying a new web application on AWS. Based on their other web applications, they anticipate being the target of frequent DDoS attacks. Which steps can the company use to protect their application? Select 2 answers from the options given below.Please select:

Use an ELB Application Load Balancer and Auto Scaling group to scale to absorb application layer traffic.

Use CloudFront and AWS WAF to prevent malicious traffic from reaching the application

Associate the EC2 instances with a security group that blocks traffic from blacklisted IP addresses.

Use an ELB Application Load Balancer and Auto Scaling group to scale to absorb application layer traffic.

Use Amazon Inspector on the EC2 instances to examine incoming traffic and discard malicious traffic.

Use CloudFront and AWS WAF to prevent malicious traffic from reaching the application

Enable GuardDuty to block malicious traffic from reaching the application

You are working in the media industry and you have created a web application where users will be able to upload photos they create to your website. This web application must be able to call the S3 API in order to be able to function. Where should you store your API credentials whilst maintaining the maximum level of security?Please select:

Don't save your API credentials, instead create a role in IAM and assign this role to an EC2 instance when you first create it.

Save the API credentials to your PHP files.

Don't save your API credentials, instead create a role in IAM and assign this role to an EC2 instance when you first create it.

Save your API credentials in a public Github repository.

Pass API credentials to the instance using instance userdata.

A company has a set of resources defined in AWS. It is mandated that all API calls to the resources be monitored. Also all API calls must be stored for lookup purposes. Any log data greater than 6 months must be archived. Which of the following meets these requirements? Choose 2 answers from the options given below. Each answer forms part of the solution. Please select:

Enable CloudTrail logging in all accounts into S3 buckets

Ensure a lifecycle policy is defined on the S3 bucket to move the data to Amazon Glacier after 6 months.

Enable CloudTrail logging in all accounts into S3 buckets

Enable CloudTrail logging in all accounts into Amazon Glacier

Ensure a lifecycle policy is defined on the S3 bucket to move the data to EBS volumes after 6 months.

Ensure a lifecycle policy is defined on the S3 bucket to move the data to Amazon Glacier after 6 months.

Amazon SCS-C01 Practice Test 7 - Free Online Exam Prep & Questions

A company is hosting a website that must be accessible to users for HTTPS traffic. Also port 22 shouldbe open for administrative purposes. The administrator's workstation has a static IP address of203.0.113.1/32. Which of the following security group configurations are the MOST secure but stillfunctional to support these requirements? Choose 2 answers from the options given belowPlease select:

Become a Premium Member for full access

Unlock Premium Member

Amazon SCS-C01 Practice Test 7

Question

Amazon SCS-C01 Practice Tests

Practice Tests