You want to launch an EC2 Instance with your own key pair in AWS. How can you achieve this?Choose 3 answers from the options given below.Please select:

Use a third party tool to create the Key pair

Create a new key pair using the AWS CLI

Use a third party tool to create the Key pair

Create a new key pair using the AWS CLI

Import the private key into EC2

You have a set of Keys defined using the AWS KMS service. You want to stop using a couple of keys , but are not sure of which services are currently using the keys. Which of the following would be a safe option to stop using the keys from further usage.Please select:

Delete the keys since anyway there is a 7 day waiting period before deletion

Change the key material for the key

You are building a large-scale confidential documentation web server on AWSand all of the documentation for it will be stored on S3. One of the requirements is that it cannot be publicly accessible from S3 directly, and you will need to use Cloud Front to accomplish this. Which of the methods listed below would satisfy the requirements as outlined? Choose an answer from the options below Please select:

Create an Origin Access Identity (OAI) for CloudFront and grant access to the objects in your S3 bucket to that OAl.

Create an Identity and Access Management (IAM) user for CloudFront and grant access to the objects in your S3 bucket to that IAM User.

Create an Origin Access Identity (OAI) for CloudFront and grant access to the objects in your S3 bucket to that OAl.

Create individual policies for each bucket the documents are stored in and in that policy grant access to only CloudFront.

Create an S3 bucket policy that lists the CloudFront distribution ID as the Principal and the target bucket as the Amazon Resource Name (ARN).

Your company makes use of S3 buckets for storing dat a. There is a company policy that all services should have logging enabled. How can you ensure that logging is always enabled for created S3 buckets in the AWS Account? Please select:

Use AWS Config Rules to check whether logging is enabled for buckets

Use AWS Inspector to inspect all S3 buckets and enable logging for those where it is not enabled

Use AWS Config Rules to check whether logging is enabled for buckets

Use AWS Cloudwatch metrics to check whether logging is enabled for buckets

Use AWS Cloudwatch logs to check whether logging is enabled for buckets

A security engineer must ensure that all infrastructure launched in the company AWS account be monitored for deviation from compliance rules, specifically that all EC2 instances are launched from one of a specified list of AM Is and that all attached EBS volumes are encrypted. Infrastructure not in compliance should be terminated. What combination of steps should the Engineer implement? Select 2 answers from the options given below.Please select:

Trigger a Lambda function from a scheduled CloudWatch event that terminates non-compliant infrastructure.

Monitor compliance with AWS Config Rules triggered by configuration changes

Set up a CloudWatch event based on Trusted Advisor metrics

Trigger a Lambda function from a scheduled CloudWatch event that terminates non-compliant infrastructure.

Set up a CloudWatch event based on Amazon inspector findings

Monitor compliance with AWS Config Rules triggered by configuration changes

Trigger a CLI command from a CloudWatch event that terminates the infrastructure

A company has external vendors that must deliver files to the company. These vendors have crossaccount that gives them permission to upload objects to one of the company's S3 buckets. What combination of steps must the vendor follow to successfully deliver a file to the company?Select 2 answers from the options given belowPlease select:

Add a grant to the objects ACL giving full permissions to bucket owner.

Upload the file to the company's S3 bucket

Attach an IAM role to the bucket that grants the bucket owner full permissions to the object

Add a grant to the objects ACL giving full permissions to bucket owner.

Encrypt the object with a KMS key controlled by the company.

Add a bucket policy to the bucket that grants the bucket owner full permissions to the object

Upload the file to the company's S3 bucket

An application running on EC2 instances in a VPC must access sensitive data in the data center. The access must be encrypted in transit and have consistent low latency. Which hybrid architecture will meet these requirements? Please select:

A VPN between the VPC and the data center over a Direct Connect connection

Expose the data with a public HTTPS endpoint.

A VPN between the VPC and the data center over a Direct Connect connection

A VPN between the VPC and the data center.

A Direct Connect connection between the VPC and data center

A company has several Customer Master Keys (CMK), some of which have imported key material.Each CMK must be rotated annually.What two methods can the security team use to rotate each key? Select 2 answers from the options given below Please select:

Enable automatic key rotation for a CMK

Import new key material to a new CMK; Point the key alias to the new CMK.

Enable automatic key rotation for a CMK

Import new key material to an existing CMK

Use the CLI or console to explicitly rotate an existing CMK

Import new key material to a new CMK; Point the key alias to the new CMK.

Delete an existing CMK and a new default CMK will be created.

A new application will be deployed on EC2 instances in private subnets. The application will transfer sensitive data to and from an S3 bucket. Compliance requirements state that the data must not traverse the public internet. Which solution meets the compliance requirement?Please select:

Access the S3 bucket through a VPC endpoint for S3

Access the S3 bucket through a proxy server

Access the S3 bucket through a NAT gateway.

Access the S3 bucket through a VPC endpoint for S3

Access the S3 bucket through the SSL protected S3 endpoint

Your current setup in AWS consists of the following architecture. 2 public subnets, one subnet which has the web servers accessed by users across the internet and the other subnet for the database server. Which of the following changes to the architecture would add a better security boundary to the resources hosted in your setup Please select:

Consider moving the database server to a private subnet

Consider moving the web server to a private subnet

Consider moving the database server to a private subnet

Consider moving both the web and database server to a private subnet

Consider creating a private subnet and adding a NAT instance to that subnet

Your company has confidential documents stored in the simple storage service. Due to compliance requirements, you have to ensure that the data in the S3 bucket is available in a different geographical location. As an architect what is the change you would make to comply with this requirement.Please select:

Enable Cross region replication for the S3 bucket

Apply Multi-AZ for the underlying 53 bucket

Copy the data to an EBS Volume in another Region

Create a snapshot of the S3 bucket and copy it to another region

Enable Cross region replication for the S3 bucket

When managing permissions for the API gateway, what can be used to ensure that the right level of permissions are given to developers, IT admins and users? These permissions should be easily managed. Please select:

Use IAM Policies to create different policies for the different types of users.

Use the secure token service to manage the permissions for the different users

Use IAM Policies to create different policies for the different types of users.

Use the AWS Config tool to manage the permissions for the different users

Use IAM Access Keys to create sets of keys for the different types of users.

A company wishes to enable Single Sign On (SSO) so its employees can login to the management console using their corporate directory identity. Which steps below are required as part of the process? Select 2 answers from the options given below.Please select:

Create a Direct Connect connection between on-premise network and AWS. Use an AD connector for connecting AWS with on-premise active directory.

Create an IAM role that establishes a trust relationship between IAM and the corporate directory identity provider (IdP)

Create a Direct Connect connection between on-premise network and AWS. Use an AD connector for connecting AWS with on-premise active directory.

Create IAM policies that can be mapped to group memberships in the corporate directory.

Create a Lambda function to assign IAM roles to the temporary security tokens provided to the users.

Create IAM users that can be mapped to the employees' corporate identities

Create an IAM role that establishes a trust relationship between IAM and the corporate directory identity provider (IdP)

A company continually generates sensitive records that it stores in an S3 bucket. All objects in the bucket are encrypted using SSE-KMS using one of the company's CMKs. Company compliance policies require that no more than one month of data be encrypted using the same encryption key.What solution below will meet the company's requirements?Please select:

Trigger a Lambda function with a monthly CloudWatch event that creates a new CMK and updates the S3 bucket to use the new CMK.

Configure the CMK to rotate the key material every month.

Trigger a Lambda function with a monthly CloudWatch event that creates a new CMK, updates the S3 bucket to use thfl new CMK, and deletes the old CMK.

Trigger a Lambda function with a monthly CloudWatch event that rotates the key material in the CMK.

Company policy requires that all insecure server protocols, such as FTP, Telnet, HTTP, etc be disabledon all servers. The security team would like to regularly check all servers to ensure compliance withthis requirement by using a scheduled CloudWatch event to trigger a review of the currentinfrastructure. What process will check compliance of the company's EC2 instances? Please select:

Run an Amazon inspector assessment using the Runtime Behavior Analysis rules package against every EC2 instance.

Trigger an AWS Config Rules evaluation of the restricted-common-ports rule against every EC2 instance.

Query the Trusted Advisor API for all best practice security checks and check for "action recommened" status.

Enable a GuardDuty threat detection analysis targeting the port configuration on every EC2 instance.

Run an Amazon inspector assessment using the Runtime Behavior Analysis rules package against every EC2 instance.

A web application runs in a VPC on EC2 instances behind an ELB Application Load Balancer. The application stores data in an RDS MySQL DB instance. A Linux bastion host is used to apply schema updates to the database - administrators connect to the host via SSH from a corporate workstation.The following security groups are applied to the infrastructure-* sgLB - associated with the ELB* sgWeb - associated with the EC2 instances.* sgDB - associated with the database* sgBastion - associated with the bastion host Which security group configuration will allow the application to be secure and functional? Please select:

sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the corporate IP address range

sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from 0.0.0.0/0 sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the corporate IP address range

sgLB :aIlow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgLB sgBastion: allow port 22 traffic from the VPC IP address range

sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the VPC IP address range

sgLB :allow port 80 and 443 traffic from 0.0.0.0/0 sgWeb :allow port 80 and 443 traffic from sgLB sgDB :allow port 3306 traffic from sgWeb and sgBastion sgBastion: allow port 22 traffic from the corporate IP address range

How can you ensure that instance in an VPC does not use AWS DNS for routing DNS requests. You want to use your own managed DNS instance. How can this be achieved? Please select:

Create a new DHCP options set and replace the existing one.

Change the existing DHCP options set

Create a new DHCP options set and replace the existing one.

Change the route table for the VPC

Change the subnet configuration to allow DNS requests from the new DNS Server

A windows machine in one VPC needs to join the AD domain in another VPC. VPC Peering has been established. But the domain join is not working. What is the other step that needs to be followed to ensure that the AD domain join can work as intended Please select:

Ensure the security groups for the AD hosted subnet has the right rule for relevant subnets

Change the VPC peering connection to a VPN connection

Change the VPC peering connection to a Direct Connect connection

Ensure the security groups for the AD hosted subnet has the right rule for relevant subnets

Ensure that the AD is placed in a public subnet

A company stores critical data in an S3 bucket. There is a requirement to ensure that an extra level of security is added to the S3 bucket. In addition , it should be ensured that objects are available in a secondary region if the primary one goes down. Which of the following can help fulfil these requirements? Choose 2 answers from the options given below Please select:

Enable bucket versioning and also enable CRR

For the Bucket policy add a condition for {"Null": {"aws:MultiFactorAuthAge": true}} i

Enable bucket versioning and also enable CRR

Enable bucket versioning and enable Master Pays

For the Bucket policy add a condition for {"Null": {"aws:MultiFactorAuthAge": true}} i

Enable the Bucket ACL and add a condition for {"Null": {"aws:MultiFactorAuthAge": true}}

Your company manages thousands of EC2 Instances. There is a mandate to ensure that all servers don't have any critical security flaws. Which of the following can be done to ensure this? Choose 2 answers from the options given below.Please select:

Use AWS inspector to ensure that the servers have no critical flaws.

Use AWS SSM to patch the servers

Use AWS Config to ensure that the servers have no critical flaws.

Use AWS inspector to ensure that the servers have no critical flaws.

Use AWS inspector to patch the servers

Use AWS SSM to patch the servers

You need to inspect the running processes on an EC2 Instance that may have a security issue. How can you achieve this in the easiest way possible. Also you need to ensure that the process does not interfere with the continuous running of the instance.Please select:

Use the SSM Run command to send the list of running processes information to an S3 bucket.

Use AWS Cloudtrail to record the processes running on the server to an S3 bucket.

Use AWS Cloudwatch to record the processes running on the server

Use the SSM Run command to send the list of running processes information to an S3 bucket.

Use AWS Config to see the changed process information on the server

You are trying to use the Systems Manager to patch a set of EC2 systems. Some of the systems are not getting covered in the patching process. Which of the following can be used to troubleshoot the issue? Choose 3 answers from the options given below.Please select:

Check to see if the right role has been assigned to the EC2 instances

Ensure that agent is running on the instances.

Check the Instance status by using the Health API.

Check to see if the right role has been assigned to the EC2 instances

Check to see if the IAM user has the right permissions for EC2

Ensure that agent is running on the instances.

Check the Instance status by using the Health API.

You are trying to use the AWS Systems Manager run command on a set of Instances. The run command on a set of Instances. What can you do to diagnose the issue? Choose 2 answers from the options given Please select:

Ensure that the SSM agent is running on the target machine

Check the /var/log/amazon/ssm/errors.log file

Ensure that the SSM agent is running on the target machine

Check the /var/log/amazon/ssm/errors.log file

Ensure the right AMI is used for the Instance

Ensure the security groups allow outbound communication for the instance

You are working for a company and been allocated the task for ensuring that there is a federated authentication mechanism setup between AWS and their On-premise Active Directory. Which of the following are important steps that need to be covered in this process? Choose 2 answers from the options given below.Please select:

Ensure the right match is in place for On-premise AD Groups and IAM Roles.

Configure AWS as the relying party in Active Directory Federation services

Ensure the right match is in place for On-premise AD Groups and IAM Roles.

Ensure the right match is in place for On-premise AD Groups and IAM Groups.

Configure AWS as the relying party in Active Directory

Configure AWS as the relying party in Active Directory Federation services

Which technique can be used to integrate AWS IAM (Identity and Access Management) with an onpremise LDAP (Lightweight Directory Access Protocol) directory service? Please select:

Use SAML (Security Assertion Markup Language) to enable single sign-on between AWS and LDAP.

Use an IAM policy that references the LDAP account identifiers and the AWS credentials.

Use SAML (Security Assertion Markup Language) to enable single sign-on between AWS and LDAP.

Use AWS Security Token Service from an identity broker to issue short-lived AWS credentials.

Use IAM roles to automatically rotate the IAM credentials when LDAP credentials are updated.

You have an EBS volume attached to an EC2 Instance which uses KMS for Encryption. Someone has now gone ahead and deleted the Customer Key which was used for the EBS encryption. What should be done to ensure the data can be decrypted.Please select:

You cannot decrypt the data that was encrypted under the CMK, and the data is not recoverable.

Create a new Customer Key using KMS and attach it to the existing volume

You cannot decrypt the data that was encrypted under the CMK, and the data is not recoverable.

Request AWS Support to recover the key

Use AWS Config to recover the key

You work as an administrator for a company. The company hosts a number of resources using AWS.There is an incident of a suspicious API activity which occurred 11 days ago. The Security Admin has asked to get the API activity from that point in time. How can this be achieved? Please select:

Search the Cloudtrail event history on the API events which occurred 11 days ago.

Search the Cloud Watch logs to find for the suspicious activity which occurred 11 days ago

Search the Cloudtrail event history on the API events which occurred 11 days ago.

Search the Cloud Watch metrics to find for the suspicious activity which occurred 11 days ago

Use AWS Config to get the API calls which were made 11 days ago.

You need to ensure that the cloudtrail logs which are being delivered in your AWS account is encrypted. How can this be achieved in the easiest way possible? Please select:

Don't do anything since CloudTrail logs are automatically encrypted.

Enable S3-SSE for the underlying bucket which receives the log files

Enable S3-KMS for the underlying bucket which receives the log files

Enable KMS encryption for the logs which are sent to Cloudwatch

You have a requirement to serve up private content using the keys available with Cloudfront. How can this be achieved? Please select:

Add the keys to the backend distribution.

Your company currently has a set of EC2 Instances hosted in a VPC. The IT Security department is suspecting a possible DDos attack on the instances. What can you do to zero in on the IP addresses which are receiving a flurry of requests. Please select:

Use VPC Flow logs to get the IP addresses accessing the EC2 Instances

Use AWS Cloud trail to get the IP addresses accessing the EC2 Instances

Use AWS Config to get the IP addresses accessing the EC2 Instances

Use AWS Trusted Advisor to get the IP addresses accessing the EC2 Instances

You are building a system to distribute confidential training videos to employees. Using CloudFront, what method could be used to serve content that is stored in S3, but not publicly accessible from S3 directly? Please select:

Create an Origin Access Identity (OAI) for CloudFront and grant access to the objects in your S3 bucket to that OAl.

Add the CloudFront account security group "amazon-cf/amazon-cf-sg" to the appropriate S3 bucket policy.

Create an Identity and Access Management (IAM) User for CloudFront and grant access to the objects in your S3 bucket to that IAM User.

Create a S3 bucket policy that lists the CloudFront distribution ID as the Principal and the target bucket as the Amazon Resource Name (ARN).

A company has an existing AWS account and a set of critical resources hosted in that account. The employee who was in-charge of the root account has left the company. What must be now done to secure the account. Choose 3 answers from the options given below.Please select:

Delete the access keys for the root account

Change the password for the root account

Change the access keys for all IAM users.

Delete all custom created IAM policies

Delete the access keys for the root account

Change the password for the root account

Change the password for all IAM users

A company had developed an incident response plan 18 months ago. Regular implementations of the response plan are carried out. No changes have been made to the response plan have been made since its creation. Which of the following is a right statement with regards to the plan?Please select:

The response plan does not cater to new services

It places too much emphasis on already implemented security controls.

The response plan is not implemented on a regular basis

The response plan does not cater to new services

The response plan is complete in its entirety

Your application currently uses customer keys which are generated via AWS KMS in the US east region. You now want to use the same set of keys from the EU-Central region. How can this be accomplished? Please select:

This is not possible since keys from KMS are region specific

Export the key from the US east region and import them into the EU-Central region

Use key rotation and rotate the existing keys to the EU-Central region

Use the backing key from the US east region and use it in the EU-Central region

This is not possible since keys from KMS are region specific

Amazon SCS-C01 Practice Test 8 - Free Online Exam Prep & Questions

Your company has a set of 1000 EC2 Instances defined in an AWS Account. They want to effectively automate several administrative tasks on these instances. Which of the following would be an effective way to achieve this? Please select:

Become a Premium Member for full access

Unlock Premium Member

Amazon SCS-C01 Practice Test 8

Question

Amazon SCS-C01 Practice Tests

Practice Tests